Extracted

Extracted

• • Target
    2026-08-25_8a48ea7372cdb8e93164b9bada4b6145_amadey_cryptbot_darkgate_glassworm_icedid_luca-stealer_njrat_stealc
  • Size 15.7MB
  • SHA256 10c06a5f2a0d2199476b9c9cd701fb10018795161541b34fea3344c1973118c1
  • MD5 8a48ea7372cdb8e93164b9bada4b6145
  • SHA1 d1bbc59cfda305ab499f1d5595c1357dab8929e2
  • SHA512 c5e0c488b0513933002823222584d0a076da3dae57f239b590ade02c83a07e35e6ced67a9a693acf39afb498065f0f6dc92ef1e92f1c24aba971547c40cecbfa
  • SSDEEP 393216:Dyz1rBdj/XmliyqYdcPx6GIaO46wpRd024:WlBdj/Xmli2dK6GBd6wfq24
  • TLSH
    T145F6AE41A2D58064F1B326756D762AB1867B7D215F38C8CF668C6D1D0BB36D2E830F2B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryexecutionpyinstallerspyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2