9e9d8c53be11cf050ed3f9e41903d084a03d830466ad2ade596b80b243b7354c

General

Target
2026-08-23_10183e73845e7f8e2de030d07baa29d5_amadey_asyncrat_elex_glassworm_hellokitty_luca-stealer_njrat_remcos_smoke-loader
Size 56.3MB
Sample260824-vpm5xa1crd
SHA256 9e9d8c53be11cf050ed3f9e41903d084a03d830466ad2ade596b80b243b7354c
MD5 10183e73845e7f8e2de030d07baa29d5
SHA1 42c8553d857494154cc46a340f9fc10f7454f9f1
SHA512 4ecd0fcd1e6ca0317047fb691b1a7c797b7813a6f63eb862bc510b634c4969d7c7f519cb41075e1da18216eb7efe064f07aea3a04164b0de21bfecafca96e874
SSDEEP 1572864:TfTBa32qryOWifPS3T58UkbG6AEBOZ27:XBapmzino58UkbGTUOM7
TLSH
T138D71225B5A5D1ABC462C834C02276F2E3B13CB5EB25C18F9A917E9F373FA898531315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-23_10183e73845e7f8e2de030d07baa29d5_amadey_asyncrat_elex_glassworm_hellokitty_luca-stealer_njrat_remcos_smoke-loader
- Size 56.3MB
- SHA256 9e9d8c53be11cf050ed3f9e41903d084a03d830466ad2ade596b80b243b7354c
- MD5 10183e73845e7f8e2de030d07baa29d5
- SHA1 42c8553d857494154cc46a340f9fc10f7454f9f1
- SHA512 4ecd0fcd1e6ca0317047fb691b1a7c797b7813a6f63eb862bc510b634c4969d7c7f519cb41075e1da18216eb7efe064f07aea3a04164b0de21bfecafca96e874
- SSDEEP 1572864:TfTBa32qryOWifPS3T58UkbG6AEBOZ27:XBapmzino58UkbGTUOM7
- TLSH
  T138D71225B5A5D1ABC462C834C02276F2E3B13CB5EB25C18F9A917E9F373FA898531315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution
- Detects executables (downlaoders) containing URLs to raw contents of a paste
- Detects executables Discord URL observed in first stage droppers
- Detects executables attemping to enumerate video devices using WMI
- Detects executables containing the string DcRatBy
- Detects executables manipulated with Fody
- Detects executables using Telegram Chat Bot
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects executables (downlaoders) containing URLs to raw contents of a paste

Detects executables Discord URL observed in first stage droppers

Detects executables attemping to enumerate video devices using WMI

Detects executables containing the string DcRatBy

Detects executables manipulated with Fody

Detects executables using Telegram Chat Bot

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2