947160ae1825ba1872b2e20bcd8dd10b4a82755078da4320ef629d0792a2a7ad

General

Target
2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar
Size 27.4MB
Sample260913-f8xfcssbme
SHA256 947160ae1825ba1872b2e20bcd8dd10b4a82755078da4320ef629d0792a2a7ad
MD5 1c4d195887cb55add8e2805a0b6dac23
SHA1 f501ffff2921b64a340af6dda721829c779849a6
SHA512 bff07eca3ea6bd335cb57425c275d90c23759d96b3b9c194c9cfcbbe93d0c4b99b99046e2d89b71e4a2c01d74f253a043f610a6f930f654b7dc7e9d8e24ebe31
SSDEEP 98304:YClvSIfRLyyAqu8ntZZffAOHLT0N2LlMJvLfMs7GXhjxTOe1:NlvSIfR9AiZNf9QuCDfMs7GRP
TLSH
T145570816F705CCD7FA16C23548DEDBA06732FCF086A5870733A8671A6FAE2889ED1451
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-09-12_1c4d195887cb55add8e2805a0b6dac23_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar
- Size 27.4MB
- SHA256 947160ae1825ba1872b2e20bcd8dd10b4a82755078da4320ef629d0792a2a7ad
- MD5 1c4d195887cb55add8e2805a0b6dac23
- SHA1 f501ffff2921b64a340af6dda721829c779849a6
- SHA512 bff07eca3ea6bd335cb57425c275d90c23759d96b3b9c194c9cfcbbe93d0c4b99b99046e2d89b71e4a2c01d74f253a043f610a6f930f654b7dc7e9d8e24ebe31
- SSDEEP 98304:YClvSIfRLyyAqu8ntZZffAOHLT0N2LlMJvLfMs7GXhjxTOe1:NlvSIfR9AiZNf9QuCDfMs7GRP
- TLSH
  T145570816F705CCD7FA16C23548DEDBA06732FCF086A5870733A8671A6FAE2889ED1451
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution exploit persistence upx
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing artifacts associated with disabling Widnows Defender
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Possible privilege escalation attempt
  exploit
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1