74c5a3f668450533d7d930807757d7850a09d98bd9fa29a535e7fc1addff9e9e

General

Target
2026-08-20_1acf27b717ff16306efa929538589669_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_ransomhub_remcos_smoke-loader_vidar
Size 14.3MB
Sample260820-dqndmayfkf
SHA256 74c5a3f668450533d7d930807757d7850a09d98bd9fa29a535e7fc1addff9e9e
MD5 1acf27b717ff16306efa929538589669
SHA1 ac1bfaade690951fbdd8a593d3ad342d8c5d71ab
SHA512 90e33f4d0b7970eee7d0e7d2dc44b3a05c6047dd2d64236c4de7ba2ffce79d8f329b674e008b2a0e81f8d449e268d9ae03d0740fc471becf84f4225ef1f858ef
SSDEEP 393216:Y2xiFxbwpaaCj2xiFxbwpaE2xiFxbwpas2xiFxbwpan2xiFxbwpa6:rUFxMp3CaUFxMpEUFxMp8UFxMprUFxMF
TLSH
T1AFE61211B3D6A5B6E0BF0639D87982A55675BD058B22C6EF53D4B9282D33BC08E31373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-20_1acf27b717ff16306efa929538589669_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_ransomhub_remcos_smoke-loader_vidar
- Size 14.3MB
- SHA256 74c5a3f668450533d7d930807757d7850a09d98bd9fa29a535e7fc1addff9e9e
- MD5 1acf27b717ff16306efa929538589669
- SHA1 ac1bfaade690951fbdd8a593d3ad342d8c5d71ab
- SHA512 90e33f4d0b7970eee7d0e7d2dc44b3a05c6047dd2d64236c4de7ba2ffce79d8f329b674e008b2a0e81f8d449e268d9ae03d0740fc471becf84f4225ef1f858ef
- SSDEEP 393216:Y2xiFxbwpaaCj2xiFxbwpaE2xiFxbwpas2xiFxbwpan2xiFxbwpa6:rUFxMp3CaUFxMpEUFxMp8UFxMprUFxMF
- TLSH
  T1AFE61211B3D6A5B6E0BF0639D87982A55675BD058B22C6EF53D4B9282D33BC08E31373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2