e9617fa8749aca7bb2cc94f3342f26e3cb8ba59789c6db0e428210595364d53d

General

Target
2026-08-31_4cd11b4d972f72d77b1142ecce9e4f54_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_ransomhub_remcos_smoke-loader_vidar
Size 12.2MB
Sample260831-zdndraer3s
SHA256 e9617fa8749aca7bb2cc94f3342f26e3cb8ba59789c6db0e428210595364d53d
MD5 4cd11b4d972f72d77b1142ecce9e4f54
SHA1 500bdd63bbf1791ce57745b22408cd775ac2ff52
SHA512 e2f9b5b87e159e1e1c510fa6244055832cd6b907d36fdc612d9558ace766ea7e9a2ab18db1c4b9a4161887fc0abdffe51372bf4bfa7e03a0f1948aa53a52cfc7
SSDEEP 196608:bofefP5xy9srq4aE7b/wR3caMdxy9srq4aE7b/w/xy9srq4aE7b/wBxy9srq4aEt:b3pWE//o3cPdpWE//0pWE//MpWE//t
TLSH
T113D61212B3E566B5D0BF0A39D87A56A56631BC045B52C7BF13A4B92D2C32BC09E31373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-31_4cd11b4d972f72d77b1142ecce9e4f54_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_ransomhub_remcos_smoke-loader_vidar
- Size 12.2MB
- SHA256 e9617fa8749aca7bb2cc94f3342f26e3cb8ba59789c6db0e428210595364d53d
- MD5 4cd11b4d972f72d77b1142ecce9e4f54
- SHA1 500bdd63bbf1791ce57745b22408cd775ac2ff52
- SHA512 e2f9b5b87e159e1e1c510fa6244055832cd6b907d36fdc612d9558ace766ea7e9a2ab18db1c4b9a4161887fc0abdffe51372bf4bfa7e03a0f1948aa53a52cfc7
- SSDEEP 196608:bofefP5xy9srq4aE7b/wR3caMdxy9srq4aE7b/w/xy9srq4aE7b/wBxy9srq4aEt:b3pWE//o3cPdpWE//0pWE//MpWE//t
- TLSH
  T113D61212B3E566B5D0BF0A39D87A56A56631BC045B52C7BF13A4B92D2C32BC09E31373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor discovery persistence privilege_escalation ransomware rat
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2