f5ffcf2701455cd73c6c812730b92ff905c0fa537809884fd00a1b5ccd1f38fa

General

Target
2026-08-15_d050440dfdd0026180769abc58186770_anydesk_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat
Size 786KB
Sample260815-215mnavejc
SHA256 f5ffcf2701455cd73c6c812730b92ff905c0fa537809884fd00a1b5ccd1f38fa
MD5 d050440dfdd0026180769abc58186770
SHA1 71d78bfdfe0d7f4fc6513d90c80911886154b224
SHA512 c3c2ff43ba8d3b37c0343d7f99ab721972383e341302ca4353331729fe39ad8c63e9068f5c3efcfc5d73d302a53b8f34b1cf9b61d742c315d272d3729b70170c
SSDEEP 12288:zo2zxgtVZBC6zaogl9jpCyq5mhoqewQad8+nFpnKt:z9zx8vC0alpCyq5yfc
TLSH
T147055C2B269802E8E1B7C179CE874D56E776780607B15EFF079049A24E7B1E05F3AB13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_d050440dfdd0026180769abc58186770_anydesk_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat
- Size 786KB
- SHA256 f5ffcf2701455cd73c6c812730b92ff905c0fa537809884fd00a1b5ccd1f38fa
- MD5 d050440dfdd0026180769abc58186770
- SHA1 71d78bfdfe0d7f4fc6513d90c80911886154b224
- SHA512 c3c2ff43ba8d3b37c0343d7f99ab721972383e341302ca4353331729fe39ad8c63e9068f5c3efcfc5d73d302a53b8f34b1cf9b61d742c315d272d3729b70170c
- SSDEEP 12288:zo2zxgtVZBC6zaogl9jpCyq5mhoqewQad8+nFpnKt:z9zx8vC0alpCyq5yfc
- TLSH
  T147055C2B269802E8E1B7C179CE874D56E776780607B15EFF079049A24E7B1E05F3AB13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion evasion persistence privilege_escalation trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2