Extracted

Extracted

Extracted

• • Target
    2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader
  • Size 26.3MB
  • SHA256 1b5c754c6cf96b160517174a3a06f7736a53f35eb7fc65c6def87e03f53e8197
  • MD5 6cd63a45dbe7d57d48800b3f1d52b3b1
  • SHA1 158c007029422481fc29195c71aa2d6f8995478a
  • SHA512 963ee125833738faea44b511029d18ccd9b1fff687111d78bf0c626f46933d213a5bd7a73d650e73727567547c7e7bb13c7d7bc90fe340a71c22e0ece76d2684
  • SSDEEP 786432:SRkdObGXYzt+GFPt7lgx+SSuiy2Qx7dH//:Akd4zUGJt7lgLSuiy2Qx7dH//
  • TLSH
    T104579D12ABD740B5F9B3023099ADE72A867FB9310531C91FF74C1A4D9B33A915A67323
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionadwarespyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Stops running service(s)

    defense_evasionexecution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2