e3006bc303faac2321d280ec4051f128ac4d732a4b549f204f281ba0e6938a97

General

Target
2026-09-16_5351884bdb3d3795276451e2dab3aeba_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar
Size 27.4MB
Sample260916-pswcssvt5p
SHA256 e3006bc303faac2321d280ec4051f128ac4d732a4b549f204f281ba0e6938a97
MD5 5351884bdb3d3795276451e2dab3aeba
SHA1 28700898b164279bcd4dc18cb6cd0c61a7c3eaaf
SHA512 ef8e03cddc252c60ee1faa80bdf6c5975742b7a4d656cc7410f6a5d90d1144b6956542d1f83329cb249e80f5d50c903e17f7ed03fd70d90eef089ccecb4b0c06
SSDEEP 98304:ZClvSIfRLyyAqu8ntZZffAOHLT0N2LlMJvLfMs7GXhjxTOe9:IlvSIfR9AiZNf9QuCDfMs7GRn
TLSH
T107570816F705CCD7FA16C23548DEDBA06732FCF086A5870733A8671A6FAE2889ED1451
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-16_5351884bdb3d3795276451e2dab3aeba_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar
- Size 27.4MB
- SHA256 e3006bc303faac2321d280ec4051f128ac4d732a4b549f204f281ba0e6938a97
- MD5 5351884bdb3d3795276451e2dab3aeba
- SHA1 28700898b164279bcd4dc18cb6cd0c61a7c3eaaf
- SHA512 ef8e03cddc252c60ee1faa80bdf6c5975742b7a4d656cc7410f6a5d90d1144b6956542d1f83329cb249e80f5d50c903e17f7ed03fd70d90eef089ccecb4b0c06
- SSDEEP 98304:ZClvSIfRLyyAqu8ntZZffAOHLT0N2LlMJvLfMs7GXhjxTOe9:IlvSIfR9AiZNf9QuCDfMs7GRn
- TLSH
  T107570816F705CCD7FA16C23548DEDBA06732FCF086A5870733A8671A6FAE2889ED1451
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing artifacts associated with disabling Widnows Defender
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1