0f38cbaa210a34380cccb06e26cfa12ff0fd2f7dd65efb7198e8c826a6fd86ae

General

Target
2026-09-16_2850ee2ca0197f2a8e30df9c9fb5d3ab_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_ransomhub_remcos_smoke-loader_vidar
Size 12.2MB
Sample260916-23nrxstyc1
SHA256 0f38cbaa210a34380cccb06e26cfa12ff0fd2f7dd65efb7198e8c826a6fd86ae
MD5 2850ee2ca0197f2a8e30df9c9fb5d3ab
SHA1 c102dcef4fb4d7c3c2092b1808794f6c46e8745c
SHA512 6ae95dd83291faf1a6caabbe4df2f273075755d812791e08f0b615fd2a2494fd1c95b46c39438b0cc5585eab1ca6b075a53acaae63259bee99d734f4b14023b5
SSDEEP 98304:O3GF0s6efPYMn1Giy8E1PqhlG6ztZNK9aNGaMn1Giy8E1PqhAMn1Giy8E1PqhrMc:AGufefP7ZWi9z3I96cZWijZWiKZWiY
TLSH
T11DD61211B3E691B5E0BF0638D87A62666631BC128751C7AF6794BE792D327C08E31373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-16_2850ee2ca0197f2a8e30df9c9fb5d3ab_amadey_elex_glassworm_hellokitty_icedid_luca-stealer_njrat_ransomhub_remcos_smoke-loader_vidar
- Size 12.2MB
- SHA256 0f38cbaa210a34380cccb06e26cfa12ff0fd2f7dd65efb7198e8c826a6fd86ae
- MD5 2850ee2ca0197f2a8e30df9c9fb5d3ab
- SHA1 c102dcef4fb4d7c3c2092b1808794f6c46e8745c
- SHA512 6ae95dd83291faf1a6caabbe4df2f273075755d812791e08f0b615fd2a2494fd1c95b46c39438b0cc5585eab1ca6b075a53acaae63259bee99d734f4b14023b5
- SSDEEP 98304:O3GF0s6efPYMn1Giy8E1PqhlG6ztZNK9aNGaMn1Giy8E1PqhAMn1Giy8E1PqhrMc:AGufefP7ZWi9z3I96cZWijZWiKZWiY
- TLSH
  T11DD61211B3E691B5E0BF0638D87A62666631BC128751C7AF6794BE792D327C08E31373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

backdoor discovery persistence privilege_escalation ransomware rat
- Detects encrypted or obfuscated .NET executables
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- ConnectWise ScreenConnect remote access tool
  ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
  backdoor rat
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1 behavioral2