shodi | badacb1274ce189bd827a1bbf592ecc78ed08ccb2536943b92155b9f8c0cf69b

General

Target
2026-08-10_12465382e900f81e0170228405f361bc_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader
Size 2.0MB
Sample260810-mxlcaafq8s
SHA256 badacb1274ce189bd827a1bbf592ecc78ed08ccb2536943b92155b9f8c0cf69b
MD5 12465382e900f81e0170228405f361bc
SHA1 c27cbd72ae1e51cb86b8321c40cec85a89987daa
SHA512 ea5afdd815d0aa0168443cf878fc0b6ffed3423484ef69bbf6e02a69d4a093ea5fda32135d9a750cbd3fee95dcfed21759ed88a5d321b71f43ad10ba6490959e
SSDEEP 49152:7xgGhqFU281K51rgXteP3Vz9oI2mhoNosVDP+fXH:CU2GK59sePl9oGoNoswfX
TLSH
T1F0A5F003F69510B8D4AAD134976A9A32BA75BC1907306EEF53806F313E75BE0AB3D744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-10_12465382e900f81e0170228405f361bc_akira_amadey_elex_hellokitty_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader
- Size 2.0MB
- SHA256 badacb1274ce189bd827a1bbf592ecc78ed08ccb2536943b92155b9f8c0cf69b
- MD5 12465382e900f81e0170228405f361bc
- SHA1 c27cbd72ae1e51cb86b8321c40cec85a89987daa
- SHA512 ea5afdd815d0aa0168443cf878fc0b6ffed3423484ef69bbf6e02a69d4a093ea5fda32135d9a750cbd3fee95dcfed21759ed88a5d321b71f43ad10ba6490959e
- SSDEEP 49152:7xgGhqFU281K51rgXteP3Vz9oI2mhoNosVDP+fXH:CU2GK59sePl9oGoNoswfX
- TLSH
  T1F0A5F003F69510B8D4AAD134976A9A32BA75BC1907306EEF53806F313E75BE0AB3D744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery shodi persistence privilege_escalation spyware stealer trojan worm
- Detects Shodi worm
- Family: Shodi
  Shodi is a Windows worm written in C++.
  worm shodi
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2