f1da5a015183df37dd09680924b5369026762cd8d4a04fc70b69a6c58d1fdd5c

General

Target
2026-09-10_d65e20f113f84c8b6f1df44fd92fa36f_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar
Size 29.6MB
Sample260910-l46fcsge27
SHA256 f1da5a015183df37dd09680924b5369026762cd8d4a04fc70b69a6c58d1fdd5c
MD5 d65e20f113f84c8b6f1df44fd92fa36f
SHA1 7622aeb49f4aba5743d9650ca132c7d44edcc5ea
SHA512 0f773ee29a1a462d268a3bf7841175e3cc8df7b50f3d4253fed43e63fa4489ab41ebaa3aa85fc8bd45484dda5c380ac9265a89f60bf1e859b947054b50db97cd
SSDEEP 98304:1+dP6pRLQCsrfv7AB7a4gm4mNSh6q+luaePEfUO:1Y6HnAT/m3xq9an9
TLSH
T1CE67D58ABB41CEC7F80681316867DF946362F9345EB0C327355D2B1EAFAF1988DA11C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-10_d65e20f113f84c8b6f1df44fd92fa36f_amadey_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_stealc_vidar
- Size 29.6MB
- SHA256 f1da5a015183df37dd09680924b5369026762cd8d4a04fc70b69a6c58d1fdd5c
- MD5 d65e20f113f84c8b6f1df44fd92fa36f
- SHA1 7622aeb49f4aba5743d9650ca132c7d44edcc5ea
- SHA512 0f773ee29a1a462d268a3bf7841175e3cc8df7b50f3d4253fed43e63fa4489ab41ebaa3aa85fc8bd45484dda5c380ac9265a89f60bf1e859b947054b50db97cd
- SSDEEP 98304:1+dP6pRLQCsrfv7AB7a4gm4mNSh6q+luaePEfUO:1Y6HnAT/m3xq9an9
- TLSH
  T1CE67D58ABB41CEC7F80681316867DF946362F9345EB0C327355D2B1EAFAF1988DA11C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing artifacts associated with disabling Widnows Defender
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2