1c7c8a407f3a6b37f7734b21ef169fc8b79d9fc6117e9b89741bbba89e9ae4c8

General

Target
2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar
Size 24.6MB
Sample260916-wt6ngsys5l
SHA256 1c7c8a407f3a6b37f7734b21ef169fc8b79d9fc6117e9b89741bbba89e9ae4c8
MD5 abf64ff2e0a99380417a81c10f3fa8d0
SHA1 c1d23e14ae7b4dea04eceda061d3fd602a28ccbe
SHA512 53ad0db4b2900660e579a23d15cc239f8b6e48278d711d2ee156a35352fabdf37457f3f6be2151e0e78c0bc3a8e649e32d5858ae70f1e28bd9ad80dc0d0314f8
SSDEEP 98304:Ks0VysGFMb1oG4QOye2F3+CMkBZ76Ya227tE:XsyT/QMIHP
TLSH
T1D747B59AB740CD83F517E23694679BF02326ECB48BB1934321917F59BF7E1898EE1184
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-16_abf64ff2e0a99380417a81c10f3fa8d0_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar
- Size 24.6MB
- SHA256 1c7c8a407f3a6b37f7734b21ef169fc8b79d9fc6117e9b89741bbba89e9ae4c8
- MD5 abf64ff2e0a99380417a81c10f3fa8d0
- SHA1 c1d23e14ae7b4dea04eceda061d3fd602a28ccbe
- SHA512 53ad0db4b2900660e579a23d15cc239f8b6e48278d711d2ee156a35352fabdf37457f3f6be2151e0e78c0bc3a8e649e32d5858ae70f1e28bd9ad80dc0d0314f8
- SSDEEP 98304:Ks0VysGFMb1oG4QOye2F3+CMkBZ76Ya227tE:XsyT/QMIHP
- TLSH
  T1D747B59AB740CD83F517E23694679BF02326ECB48BB1934321917F59BF7E1898EE1184
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Detects executables calling ClearMyTracksByProcess
- Detects executables containing artifacts associated with disabling Widnows Defender
- UPX dump on OEP (original entry point)
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2