c4d93060018ea08e885a6c6234cbcba3670bf8c2a63c9afa375ff9cd369c840c

General

Target
2026-08-22_d6ef845a5a232405d121fd66ca734ab9_blackenergy_glassworm_hacktools_mimikatz_qilin_wannacry
Size 28.0MB
Sample260822-3efbbavxf1
SHA256 c4d93060018ea08e885a6c6234cbcba3670bf8c2a63c9afa375ff9cd369c840c
MD5 d6ef845a5a232405d121fd66ca734ab9
SHA1 ebe01c46631de759d9860634cb35ddf400ab505c
SHA512 c0c2603f082c5379c7ac34841270eb10582dc119d3f082ebf4e4b2b3d66a7ba937e801be7ac38d3ce05345dc1d592725065bd647f32cdf417b0dd3f6bf3542fc
SSDEEP 98304:WXD2vdZ7TXhpKr6b/87ZfQINBY4vqw7WZASpl+gg6d2J4hD3TguW1BtUH2+62ZQJ:yofemAfQIvxqaxSLIuhD3sh8a22
TLSH
T19D57756832B94452E2A9C079E907875BCD60309A573D94FFD141CDD8BF207FCAA7CA62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-22_d6ef845a5a232405d121fd66ca734ab9_blackenergy_glassworm_hacktools_mimikatz_qilin_wannacry
- Size 28.0MB
- SHA256 c4d93060018ea08e885a6c6234cbcba3670bf8c2a63c9afa375ff9cd369c840c
- MD5 d6ef845a5a232405d121fd66ca734ab9
- SHA1 ebe01c46631de759d9860634cb35ddf400ab505c
- SHA512 c0c2603f082c5379c7ac34841270eb10582dc119d3f082ebf4e4b2b3d66a7ba937e801be7ac38d3ce05345dc1d592725065bd647f32cdf417b0dd3f6bf3542fc
- SSDEEP 98304:WXD2vdZ7TXhpKr6b/87ZfQINBY4vqw7WZASpl+gg6d2J4hD3TguW1BtUH2+62ZQJ:yofemAfQIvxqaxSLIuhD3sh8a22
- TLSH
  T19D57756832B94452E2A9C079E907875BCD60309A573D94FFD141CDD8BF207FCAA7CA62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects command variations typically used by ransomware
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
- Detects executables containing commands for clearing Windows Event Logs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables using Telegram Chat Bot
- detects Windows exceutables potentially bypassing UAC using eventvwr.exe
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

Detects command variations typically used by ransomware

Detects executables (downlaoders) containing URLs to raw contents of a paste

Detects executables calling ClearMyTracksByProcess

Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r

Detects executables containing commands for clearing Windows Event Logs

Detects executables embedding registry key / value combination indicative of disabling Windows Defen

Detects executables referencing many IR and analysis tools

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

Detects executables using Telegram Chat Bot

detects Windows exceutables potentially bypassing UAC using eventvwr.exe

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2