f2116d83dd89ceb38e9c32eca79ad383764a94eac7067ddf1c69469a1fae2161

General

Target
2026-08-16_2e8b0db4a04cd280faed7aceed0c3cbb_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_remcos_vidar
Size 35.0MB
Sample260816-sbd9qszhqd
SHA256 f2116d83dd89ceb38e9c32eca79ad383764a94eac7067ddf1c69469a1fae2161
MD5 2e8b0db4a04cd280faed7aceed0c3cbb
SHA1 ceb6dd6a3eaad829fd72883cc7021f3b3eea8331
SHA512 faaaa4c1cba99c1625f3b18baa53715f685290bd75422600f19ac652b7ce336f32c36f35e201427c9f19aa9727dda1fef5f959e3a558b0c1b2580be739bb3f1c
SSDEEP 196608:eQnmE+fMeDKqTnrT+B7A6Z6dSBqtiEPFNPL12V5pvUFgAr:zKJnGBr4Xu7vUd
TLSH
T13F87074ABB40CEE6E11A85B098A77B1163FEFD6147E1C30321C83B15DF1B29D4EA7598
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-16_2e8b0db4a04cd280faed7aceed0c3cbb_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_remcos_vidar
- Size 35.0MB
- SHA256 f2116d83dd89ceb38e9c32eca79ad383764a94eac7067ddf1c69469a1fae2161
- MD5 2e8b0db4a04cd280faed7aceed0c3cbb
- SHA1 ceb6dd6a3eaad829fd72883cc7021f3b3eea8331
- SHA512 faaaa4c1cba99c1625f3b18baa53715f685290bd75422600f19ac652b7ce336f32c36f35e201427c9f19aa9727dda1fef5f959e3a558b0c1b2580be739bb3f1c
- SSDEEP 196608:eQnmE+fMeDKqTnrT+B7A6Z6dSBqtiEPFNPL12V5pvUFgAr:zKJnGBr4Xu7vUd
- TLSH
  T13F87074ABB40CEE6E11A85B098A77B1163FEFD6147E1C30321C83B15DF1B29D4EA7598
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation spyware trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing artifacts associated with disabling Widnows Defender
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2