Extracted

• • Target
    2026-09-24_cde4890e3281042437cde7994b986e98_amadey_cloudeye_coinminer_cryptbot_darkgate_elex_glassworm_remcos_rhadamanthys_smoke-loader_wannacry
  • Size 15.8MB
  • SHA256 24f81441ad693464a8ec9cb27f867578128e3885749a137539af1249b5e7eb3b
  • MD5 cde4890e3281042437cde7994b986e98
  • SHA1 ea496ac8d274173520b717ea1cd53ce1121bd269
  • SHA512 5e51358a601941dc14b002fd533bdf495390f1240a5fcc74c84727fe5b0ecb92db27c95e8d812c49e040e722db56122a0430b8be096411626eb234e7702287e4
  • SSDEEP 393216:b3foCkhfO/zFXGW/F/P9wXiXzThrI5ey08epzhZ:bPRkdObGXYztU5eyAzH
  • TLSH
    T1F5F6AE11FBC300B0F663527185AAD33BC63B7A114532DDAFF74C9949BB33691592A32A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryexecutionpersistencespywarestealer

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  behavioral1behavioral2
• • Target
    $EXEDIR/OInstall.exe
  • Size 15.7MB
  • SHA256 2954dd074ed64fc3f99e84d4db4bd609aed6fd7e5c1e15353eb6d73ff6052c42
  • MD5 b7d95fe69642a95d87ef68947727413d
  • SHA1 83e0ddba434cc00d818c496599f4b1c0c2453a96
  • SHA512 a5eaf656349f5e2488101512eae902b92b7d23498b0435a4e6ca8efef2e5b81a81cc75273fa7ee9b014a2a786f293f5fc02db1e82450bc4c6821bb9bbc509b08
  • SSDEEP 393216:QfoCkhfO/zFXGW/F/P9wXiXzThrI5ey08epzh:iRkdObGXYztU5eyAz
  • TLSH
    T16CF6AE11FBC300B0F663527185AAD33BC6377A114532DEAFF74C9949BB33691592A32A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutionspyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/INetC.dll
  • Size 25KB
  • SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
  • MD5 40d7eca32b2f4d29db98715dd45bfac5
  • SHA1 124df3f617f562e46095776454e1c0c7bb791cc7
  • SHA512 5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
  • SSDEEP 384:pjj9e9dE95XD+iTx58Y5oMM3O9MEoLr1VcQZ/ZwcSyekMRlZ4L4:dAvE90GuY2tO93oLrJRM7Z4E
  • TLSH
    T1F0B2F99257EA179AF7BAAB3478B9E762497FBC211821CCCF5533068D1872241ED30727
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    $PLUGINSDIR/nsExec.dll
  • Size 7KB
  • SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
  • MD5 c953dd0aab774f1446fcd63fa7c5f613
  • SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
  • SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
  • SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
  • TLSH
    T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7behavioral8