b8809e27701f2dad7c8782761c3c09caf777240b95e7ae7cf08004664fb38b7c | Triage™

Login
Reports

Overview

overview

Static

static

2026-08-25...jr.exe

windows10-2004-x64

8

2026-08-25...jr.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_f2d1f748d83fe24d31220c081ee12a42_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_ransomhub_remcos_smoke-loader_vidar
Size 17.4MB
Sample260826-cx2n6abe32
SHA256 b8809e27701f2dad7c8782761c3c09caf777240b95e7ae7cf08004664fb38b7c
MD5 f2d1f748d83fe24d31220c081ee12a42
SHA1 2324a48e16b753a8fc2814c7f8b892c657830aa0
SHA512 af0372d3a37b9f31a8613b5a51cd089adfbbfeb3f63bc4aff3f2a0f48f7e7516d8aad2f6b85c1470de00e4dc859b56c55377dd566dcd651d1e1a739641a5dc90
SSDEEP 393216:zbL8LbI2R6OYj+X/a/ZDK+X/a/H+X/a/K+X/a/n:AYj+X/a/Z2+X/a/H+X/a/K+X/a/n
TLSH
T17B071205B7CAA576D4BE0639D8755210A774FC418B23C7AF5AE0BE3D1C317C0AE2639A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery ransomware

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

2026-08-25_f2d1f748d83fe24d31220c081ee12a42_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

18 signatures

150 seconds

discovery ransomware

Behavioral task

behavioral2

Sample

2026-08-25_f2d1f748d83fe24d31220c081ee12a42_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njr.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

17 signatures

150 seconds

discovery ransomware

Malware Config

Targets

- Target
  2026-08-25_f2d1f748d83fe24d31220c081ee12a42_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_ransomhub_remcos_smoke-loader_vidar
- Size 17.4MB
- SHA256 b8809e27701f2dad7c8782761c3c09caf777240b95e7ae7cf08004664fb38b7c
- MD5 f2d1f748d83fe24d31220c081ee12a42
- SHA1 2324a48e16b753a8fc2814c7f8b892c657830aa0
- SHA512 af0372d3a37b9f31a8613b5a51cd089adfbbfeb3f63bc4aff3f2a0f48f7e7516d8aad2f6b85c1470de00e4dc859b56c55377dd566dcd651d1e1a739641a5dc90
- SSDEEP 393216:zbL8LbI2R6OYj+X/a/ZDK+X/a/H+X/a/K+X/a/n:AYj+X/a/Z2+X/a/H+X/a/K+X/a/n
- TLSH
  T17B071205B7CAA576D4BE0639D8755210A774FC418B23C7AF5AE0BE3D1C317C0AE2639A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryransomware

behavioral2

discoveryransomware

© 2018-2026

Terms | Privacy