fdae8e2a55c5a99f3b8e11cb53699f238de5c30b386150ebc2d14629b908fcb9

General

Target
2026-08-17_ecd7a852d9a10e24ab3166ad780a9d96_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_remcos_vidar
Size 35.0MB
Sample260817-mftbkayvay
SHA256 fdae8e2a55c5a99f3b8e11cb53699f238de5c30b386150ebc2d14629b908fcb9
MD5 ecd7a852d9a10e24ab3166ad780a9d96
SHA1 6bf9d73650d06efc9868043894c67d646906903c
SHA512 193436a6f24e96036736e0828fd3a3e095ba6af4e0603ee6c18ddcf6a0db14d6bb9c9347b5fd5fcccc0a89da6c4ecc8bfdb6ab9830aa49e88bf5c9d9bc8f7510
SSDEEP 196608:ZQnmE+fMeDKqTnrT+B7A6Z6dSBqtiEPFNPL12V5pvUFgAW:qKJnGBr4Xu7vUQ
TLSH
T19187074ABB40CEE6E11A85B098A77B1163FEFD6147E1C30321C83B15DF1B29D4EA7598
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-17_ecd7a852d9a10e24ab3166ad780a9d96_amadey_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_poet-rat_quasar-rat_remcos_vidar
- Size 35.0MB
- SHA256 fdae8e2a55c5a99f3b8e11cb53699f238de5c30b386150ebc2d14629b908fcb9
- MD5 ecd7a852d9a10e24ab3166ad780a9d96
- SHA1 6bf9d73650d06efc9868043894c67d646906903c
- SHA512 193436a6f24e96036736e0828fd3a3e095ba6af4e0603ee6c18ddcf6a0db14d6bb9c9347b5fd5fcccc0a89da6c4ecc8bfdb6ab9830aa49e88bf5c9d9bc8f7510
- SSDEEP 196608:ZQnmE+fMeDKqTnrT+B7A6Z6dSBqtiEPFNPL12V5pvUFgAW:qKJnGBr4Xu7vUQ
- TLSH
  T19187074ABB40CEE6E11A85B098A77B1163FEFD6147E1C30321C83B15DF1B29D4EA7598
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence trojan upx
- Windows security bypass
  defense_evasion trojan
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing artifacts associated with disabling Widnows Defender
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2