a5b2e95b3ed0d4ed7e50f88e36df39bf7236a121dd0ef968ecb51a5f1332a7b8

General

Target
2026-09-10_fe060394028dda379182ecfae2acd518_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar
Size 29.6MB
Sample260910-ka3a6stsev
SHA256 a5b2e95b3ed0d4ed7e50f88e36df39bf7236a121dd0ef968ecb51a5f1332a7b8
MD5 fe060394028dda379182ecfae2acd518
SHA1 e438b7ca225d88067b02d944b5e02305bcd1ff7a
SHA512 cdd180f883ba445c80bd9e51dea983ec98c4ec5aa8822cd167eccebaeec11259affa355050ac6c66381ef0ea805950e211c533743ed3945aec8b0dfe0e1c4991
SSDEEP 98304:K+dP6pRLQCsrfv7AB7a4gm4mNSh6q+luaePEfUd:KY6HnAT/m3xq9anu
TLSH
T1B267D58ABB41CEC7F80681316867DF946362F9345EB0C327355D2B1EAFAF1988DA11C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-10_fe060394028dda379182ecfae2acd518_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar
- Size 29.6MB
- SHA256 a5b2e95b3ed0d4ed7e50f88e36df39bf7236a121dd0ef968ecb51a5f1332a7b8
- MD5 fe060394028dda379182ecfae2acd518
- SHA1 e438b7ca225d88067b02d944b5e02305bcd1ff7a
- SHA512 cdd180f883ba445c80bd9e51dea983ec98c4ec5aa8822cd167eccebaeec11259affa355050ac6c66381ef0ea805950e211c533743ed3945aec8b0dfe0e1c4991
- SSDEEP 98304:K+dP6pRLQCsrfv7AB7a4gm4mNSh6q+luaePEfUd:KY6HnAT/m3xq9anu
- TLSH
  T1B267D58ABB41CEC7F80681316867DF946362F9345EB0C327355D2B1EAFAF1988DA11C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing artifacts associated with disabling Widnows Defender
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2