c627206a7af68daf81878b3383e2c62f8ec4b590799e6e12639cc907fc2131a6

General

Target
2026-08-15_d64e3b2540d8df6befe1a9f680721eff_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee
Size 8.4MB
Sample260815-v4d6js1ajh
SHA256 c627206a7af68daf81878b3383e2c62f8ec4b590799e6e12639cc907fc2131a6
MD5 d64e3b2540d8df6befe1a9f680721eff
SHA1 879130cc684c7d333ccc4cd3bc063b385c8f7bb5
SHA512 8819575a6760c8d8bdea36d3030be418f1f633b5339bc299eb5a32323956083eb325eca683c987cb7fcc379f5fe6250d85a3582635b854213efd1406ec5c3273
SSDEEP 196608:v2f2CslfeJfWXoHdvCn222wm0Pm2qojJ6Fw3P6UI:+Ox61K2wnhNl3P6p
TLSH
T1B696D01731974035C59A4130C659BEF435FABA611FA298EF2FC89DDC2B225D0A632F63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_d64e3b2540d8df6befe1a9f680721eff_amadey_cloudeye_darkgate_elex_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 8.4MB
- SHA256 c627206a7af68daf81878b3383e2c62f8ec4b590799e6e12639cc907fc2131a6
- MD5 d64e3b2540d8df6befe1a9f680721eff
- SHA1 879130cc684c7d333ccc4cd3bc063b385c8f7bb5
- SHA512 8819575a6760c8d8bdea36d3030be418f1f633b5339bc299eb5a32323956083eb325eca683c987cb7fcc379f5fe6250d85a3582635b854213efd1406ec5c3273
- SSDEEP 196608:v2f2CslfeJfWXoHdvCn222wm0Pm2qojJ6Fw3P6UI:+Ox61K2wnhNl3P6p
- TLSH
  T1B696D01731974035C59A4130C659BEF435FABA611FA298EF2FC89DDC2B225D0A632F63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware defense_evasion discovery execution installer persistence privilege_escalation spyware stealer upx
- Detects executables packed with VMProtect.
- UPX dump on OEP (original entry point)
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2