28b4f8aea9495d108f394e7f746cf61009264d97eb4e4142b24d5f3c0bddf840

General

Target
2026-08-27_ec005cd0b570d0691157b96b4d5b3fe3_coinminer_glassworm_icedid_njrat_poet-rat_remcos
Size 24.5MB
Sample260828-dep33ssve1
SHA256 28b4f8aea9495d108f394e7f746cf61009264d97eb4e4142b24d5f3c0bddf840
MD5 ec005cd0b570d0691157b96b4d5b3fe3
SHA1 0af28c3b8a25c32f8a68ccd0fa1fc9b80bf9e09f
SHA512 dd71b6bea33c7106a5411d99e42d6adfac804baa27a9981e351ae0b1211a45bbb44a85f5b0bd8cfab385c4146b9cc4691cc3a5ffb6743258eabc77950843dda8
SSDEEP 49152:cudCDvwT4vKKbhWj0wjlktD4a0CfZ1Cy988xJhGnSDJEKHMvtrI72dRt8rfIkatY:ivKKbh6Jta+UUamsrfszizYP14
TLSH
T16E476216B746898BE42A9634844B4FE4E325DCB186B0837733B9371D2FFE34C5EA6215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-27_ec005cd0b570d0691157b96b4d5b3fe3_coinminer_glassworm_icedid_njrat_poet-rat_remcos
- Size 24.5MB
- SHA256 28b4f8aea9495d108f394e7f746cf61009264d97eb4e4142b24d5f3c0bddf840
- MD5 ec005cd0b570d0691157b96b4d5b3fe3
- SHA1 0af28c3b8a25c32f8a68ccd0fa1fc9b80bf9e09f
- SHA512 dd71b6bea33c7106a5411d99e42d6adfac804baa27a9981e351ae0b1211a45bbb44a85f5b0bd8cfab385c4146b9cc4691cc3a5ffb6743258eabc77950843dda8
- SSDEEP 49152:cudCDvwT4vKKbhWj0wjlktD4a0CfZ1Cy988xJhGnSDJEKHMvtrI72dRt8rfIkatY:ivKKbh6Jta+UUamsrfszizYP14
- TLSH
  T16E476216B746898BE42A9634844B4FE4E325DCB186B0837733B9371D2FFE34C5EA6215
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing artifacts associated with disabling Widnows Defender
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2