f7252eeaa799ca2b18857a19db408fbd91ece41c8be0bd7dc376de5ff7a9118f

General

Target
2026-09-12_b59c100832e4f52e1cb9bc3edae8ebbd_amadey_luca-stealer_njrat_ransomhub_remcos_smoke-loader
Size 13.6MB
Sample260912-xttjlashka
SHA256 f7252eeaa799ca2b18857a19db408fbd91ece41c8be0bd7dc376de5ff7a9118f
MD5 b59c100832e4f52e1cb9bc3edae8ebbd
SHA1 6d0cc746db2184580b755d138e192005450216b8
SHA512 db44dc7c81dc38bfdbc3de17c44ff7a259363ded5c99f0ea8f7a5a782db16e89bcd5d431c835fdde23aeab559742ef582996c8fbb003009e2afbbe9e6a26e022
SSDEEP 196608:b4RydtHxcp9ym3nltDUJV9Hxcp9ym3YHxcp9ym39Hxcp9ym38Hxcp9ym3ex1hAK3:bCyFGplpaGpmGpvGpaGpK1j
TLSH
T196E6F106ACE518E6D16962B78D7705917B38FC491B26A3CB2A10BB3C2DF76D49C3B314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-12_b59c100832e4f52e1cb9bc3edae8ebbd_amadey_luca-stealer_njrat_ransomhub_remcos_smoke-loader
- Size 13.6MB
- SHA256 f7252eeaa799ca2b18857a19db408fbd91ece41c8be0bd7dc376de5ff7a9118f
- MD5 b59c100832e4f52e1cb9bc3edae8ebbd
- SHA1 6d0cc746db2184580b755d138e192005450216b8
- SHA512 db44dc7c81dc38bfdbc3de17c44ff7a259363ded5c99f0ea8f7a5a782db16e89bcd5d431c835fdde23aeab559742ef582996c8fbb003009e2afbbe9e6a26e022
- SSDEEP 196608:b4RydtHxcp9ym3nltDUJV9Hxcp9ym3YHxcp9ym39Hxcp9ym38Hxcp9ym3ex1hAK3:bCyFGplpaGpmGpvGpaGpK1j
- TLSH
  T196E6F106ACE518E6D16962B78D7705917B38FC491B26A3CB2A10BB3C2DF76D49C3B314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

backdoor discovery persistence privilege_escalation rat revoked_codesign
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2