Overview

overview

10

Static

static

10

2026-08-30...in.exe

windows10-2004-x64

10

2026-08-30...in.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-08-30_062f96b466c17a65b9978dadd387a3c8_blackenergy_conti_glassworm_qilin
  • Size 804KB
  • Sample260830-173k7stsew
  • SHA256 894e0f2a07128348b18a9de42627053951c3d6d55055475283f0b20e181065d0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
persistence

Malware Config

Targets

    • Target
      2026-08-30_062f96b466c17a65b9978dadd387a3c8_blackenergy_conti_glassworm_qilin
    • Size 804KB
    • SHA256 894e0f2a07128348b18a9de42627053951c3d6d55055475283f0b20e181065d0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    persistence

    • Modifies WinLogon for persistence

      persistence

    • Detects command variations typically used by ransomware

    • Detects executables built or packed with MPress PE compressor

    • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

    • Detects executables packed with Enigma

    • Detects executables packed with VMProtect.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Modifies system executable filetype association

      persistence

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks