198cd5c115bdbd368045a4fc4cff836f82d0d5aee53849e1d65a0ab65187beeb

General

Target
2026-08-11_4cc7118142b752ab9bd3ac3d28b4967a_amadey_luca-stealer_njrat_ransomhub_remcos_smoke-loader
Size 13.4MB
Sample260812-aa4twsvcla
SHA256 198cd5c115bdbd368045a4fc4cff836f82d0d5aee53849e1d65a0ab65187beeb
MD5 4cc7118142b752ab9bd3ac3d28b4967a
SHA1 58169698d9118048371f26922c961f2159cfae89
SHA512 404eda1bd02575f1d2cb7e15805f2842bff84f2a453897d19ab2ac3e69ed6ad199ff8b3c2e95487e0ca10a843d690dbcd77616d1f47ed5467ee22d92f5b84976
SSDEEP 196608:b4Ryd4Hxcp9ym3nltDUJViHxcp9ym3YHxcp9ym39Hxcp9ym3FHxcp9ym3Yx1JAKa:bCyYGplp5GpmGpvGp3GpI1
TLSH
T191E6F107ACE518E6C16A92B78D3705917B75FC491B26A3CB2A10BB3C2DF66D49C3B314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-11_4cc7118142b752ab9bd3ac3d28b4967a_amadey_luca-stealer_njrat_ransomhub_remcos_smoke-loader
- Size 13.4MB
- SHA256 198cd5c115bdbd368045a4fc4cff836f82d0d5aee53849e1d65a0ab65187beeb
- MD5 4cc7118142b752ab9bd3ac3d28b4967a
- SHA1 58169698d9118048371f26922c961f2159cfae89
- SHA512 404eda1bd02575f1d2cb7e15805f2842bff84f2a453897d19ab2ac3e69ed6ad199ff8b3c2e95487e0ca10a843d690dbcd77616d1f47ed5467ee22d92f5b84976
- SSDEEP 196608:b4Ryd4Hxcp9ym3nltDUJViHxcp9ym3YHxcp9ym39Hxcp9ym3FHxcp9ym3Yx1JAKa:bCyYGplp5GpmGpvGp3GpI1
- TLSH
  T191E6F107ACE518E6C16A92B78D3705917B75FC491B26A3CB2A10BB3C2DF66D49C3B314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

backdoor discovery persistence privilege_escalation rat revoked_codesign
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2