05851dade6fab7ac5fc0c64de92872c0b569306beebdd47f508064c62faa10d2

General

Target
2026-08-16_472fb85ec86f6d052c113c64ee3bf1f9_amadey_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar
Size 40.5MB
Sample260816-fa9yssz1e1
SHA256 05851dade6fab7ac5fc0c64de92872c0b569306beebdd47f508064c62faa10d2
MD5 472fb85ec86f6d052c113c64ee3bf1f9
SHA1 0188348c583ebaf84305d45715c74e4f68da9d26
SHA512 f02b68b8e1dc4b2e6a51a5bbe150d0efe23ca9ff6e4f13d34daf285a1a79229c995089f366bd2561e1ea63bb7f781f46e2cdb9ca16b10982842a7113a8755d43
SSDEEP 98304:nu/9nmRrRF3xMz1HbbXZ53M2Q5IU9DB1HbbXZ53M2Q5IUpAeru:uFnmRrbuh7c2QHdh7c2Q3Aea
TLSH
T1EB97734AB711CD49D123A239545B9F90E372EDB187B1936333B57B2D2EFA38C8DA2144
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-16_472fb85ec86f6d052c113c64ee3bf1f9_amadey_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar
- Size 40.5MB
- SHA256 05851dade6fab7ac5fc0c64de92872c0b569306beebdd47f508064c62faa10d2
- MD5 472fb85ec86f6d052c113c64ee3bf1f9
- SHA1 0188348c583ebaf84305d45715c74e4f68da9d26
- SHA512 f02b68b8e1dc4b2e6a51a5bbe150d0efe23ca9ff6e4f13d34daf285a1a79229c995089f366bd2561e1ea63bb7f781f46e2cdb9ca16b10982842a7113a8755d43
- SSDEEP 98304:nu/9nmRrRF3xMz1HbbXZ53M2Q5IU9DB1HbbXZ53M2Q5IUpAeru:uFnmRrbuh7c2QHdh7c2Q3Aea
- TLSH
  T1EB97734AB711CD49D123A239545B9F90E372EDB187B1936333B57B2D2EFA38C8DA2144
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing artifacts associated with disabling Widnows Defender
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2