26f14364075f084be9a1c444a9f136a263f1254769b57e144e15d31e16146e14

General

Target
2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_ransomhub_remcos_smoke-loader_vidar
Size 20.5MB
Sample260818-3lp44abj2s
SHA256 26f14364075f084be9a1c444a9f136a263f1254769b57e144e15d31e16146e14
MD5 6df9efdb596933d37203c8047c98ce39
SHA1 25cacffbc02a5ae1292857825e88062cd907fd24
SHA512 e666bb6e8e1285fb337565f16788194b809530aae428173444dd1d47add1a47eefd5c61816e75cbe4d2307e59918c85277b81e550e7ea926c5f783fdc226c53c
SSDEEP 393216:itkqBojkqBNkqBikqBwkqBIkqBWkqB4kqBv:zg
TLSH
T1A7272212B3E54565D1BB1A38E8B946965A35BC054B12C2BF52A8B96E3D33FC0DD32333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-18_6df9efdb596933d37203c8047c98ce39_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_ransomhub_remcos_smoke-loader_vidar
- Size 20.5MB
- SHA256 26f14364075f084be9a1c444a9f136a263f1254769b57e144e15d31e16146e14
- MD5 6df9efdb596933d37203c8047c98ce39
- SHA1 25cacffbc02a5ae1292857825e88062cd907fd24
- SHA512 e666bb6e8e1285fb337565f16788194b809530aae428173444dd1d47add1a47eefd5c61816e75cbe4d2307e59918c85277b81e550e7ea926c5f783fdc226c53c
- SSDEEP 393216:itkqBojkqBNkqBikqBwkqBIkqBWkqB4kqBv:zg
- TLSH
  T1A7272212B3E54565D1BB1A38E8B946965A35BC054B12C2BF52A8B96E3D33FC0DD32333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

backdoor discovery execution persistence privilege_escalation ransomware rat
- Detects encrypted or obfuscated .NET executables
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2