e206b929ad1bf84789bbe06ddaa09bab46dc8e392e234f75461932f40d48ee78

General

Target
2026-09-10_eb369c189af76e7b25d4cab541272eec_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar
Size 33.8MB
Sample260910-k66y8sam4s
SHA256 e206b929ad1bf84789bbe06ddaa09bab46dc8e392e234f75461932f40d48ee78
MD5 eb369c189af76e7b25d4cab541272eec
SHA1 4ec06166b47cb7f9c8fddbf964cd697d0f768b66
SHA512 20b23c397f1737e3cba9a9b3085569f81832212468173fe6273aa71cde204baa247895b701f748c4a3a48cc7ea5df7fc66e435ff975f47a4948572bbc499e7a1
SSDEEP 98304:O+dP6pfrf0qBvdAmx6bc4a+4Z7eSv5GdCdAmQc:OY6VsqIuH6S0dCdAmn
TLSH
T13B777012B7018DDFF066A234689B8F61E332D8B106B1937723B1675D1FEE38C4EA6564
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-10_eb369c189af76e7b25d4cab541272eec_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar
- Size 33.8MB
- SHA256 e206b929ad1bf84789bbe06ddaa09bab46dc8e392e234f75461932f40d48ee78
- MD5 eb369c189af76e7b25d4cab541272eec
- SHA1 4ec06166b47cb7f9c8fddbf964cd697d0f768b66
- SHA512 20b23c397f1737e3cba9a9b3085569f81832212468173fe6273aa71cde204baa247895b701f748c4a3a48cc7ea5df7fc66e435ff975f47a4948572bbc499e7a1
- SSDEEP 98304:O+dP6pfrf0qBvdAmx6bc4a+4Z7eSv5GdCdAmQc:OY6VsqIuH6S0dCdAmn
- TLSH
  T13B777012B7018DDFF066A234689B8F61E332D8B106B1937723B1675D1FEE38C4EA6564
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing artifacts associated with disabling Widnows Defender
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2