17f5b9ba04af8da7caa37ac9571ef77d980bd75f15ae7c8f51c93406dd18d68d | Triage™

Login
Reports

Overview

overview

7

Static

static

3

2026-09-27...ar.exe

windows10-2004-x64

7

2026-09-27...ar.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...in.exe

windows10-2004-x64

1

$PLUGINSDI...in.exe

windows11-ltsc_2024-x64

1

$PLUGINSDI...nt.dll

windows10-2004-x64

1

$PLUGINSDI...nt.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...64.exe

windows10-2004-x64

4

$PLUGINSDI...64.exe

windows11-ltsc_2024-x64

4

Uninstall.exe

windows10-2004-x64

7

Uninstall.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-27_73a3fd124328e1123d281202ac139356_akira_amadey_cobalt-strike_elex_glassworm_luca-stealer_njrat_remcos_vidar
Size 22.9MB
Sample260928-e8x68avt6l
SHA256 17f5b9ba04af8da7caa37ac9571ef77d980bd75f15ae7c8f51c93406dd18d68d
MD5 73a3fd124328e1123d281202ac139356
SHA1 55c8c394addc0823d39e60daaca73bb0b885339b
SHA512 c0da1ff396540438c7d8ad90673269f54fa592655fc2167034044be0e561ba61e486731a6b4c15c4d201d98eca5269caa42c3cd309315a42282efe7ba0ffb6b8
SSDEEP 393216:zFeCpQ/hbBWGW1tkWSz61gUM0SOm53TgypRvlxoMtBpMw4OrsxJ9:QCpQpbQ1tBj1gR0SP53tRvlLpM2w9
TLSH
T19B370112BA9A546CD4BAC470935747726E3178CA1B34B9FF41C492783E79BF06B38329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2026-09-27_73a3fd124328e1123d281202ac139356_akira_amadey_cobalt-strike_elex_glassworm_luca-stealer_njrat_remcos_vidar.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

2026-09-27_73a3fd124328e1123d281202ac139356_akira_amadey_cobalt-strike_elex_glassworm_luca-stealer_njrat_remcos_vidar.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral3

Sample

$PLUGINSDIR/InstallOptions.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/InstallOptions.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

$PLUGINSDIR/StartMenu.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

$PLUGINSDIR/StartMenu.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral7

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral8

Sample

$PLUGINSDIR/System.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral9

Sample

$PLUGINSDIR/UserInfo.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

$PLUGINSDIR/UserInfo.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral11

Sample

$PLUGINSDIR/coreform_license_login.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

$PLUGINSDIR/coreform_license_login.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

$PLUGINSDIR/licensing_client.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

$PLUGINSDIR/licensing_client.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral16

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral17

Sample

$PLUGINSDIR/vc_redist.x64.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral18

Sample

$PLUGINSDIR/vc_redist.x64.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

5 signatures

150 seconds

Behavioral task

behavioral19

Sample

Uninstall.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

6 signatures

150 seconds

defense_evasion discovery

Behavioral task

behavioral20

Sample

Uninstall.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

6 signatures

150 seconds

defense_evasion discovery

Behavioral task

behavioral21

Sample

$PLUGINSDIR/UserInfo.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral22

Sample

$PLUGINSDIR/UserInfo.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Malware Config

Targets

- Target
  2026-09-27_73a3fd124328e1123d281202ac139356_akira_amadey_cobalt-strike_elex_glassworm_luca-stealer_njrat_remcos_vidar
- Size 22.9MB
- SHA256 17f5b9ba04af8da7caa37ac9571ef77d980bd75f15ae7c8f51c93406dd18d68d
- MD5 73a3fd124328e1123d281202ac139356
- SHA1 55c8c394addc0823d39e60daaca73bb0b885339b
- SHA512 c0da1ff396540438c7d8ad90673269f54fa592655fc2167034044be0e561ba61e486731a6b4c15c4d201d98eca5269caa42c3cd309315a42282efe7ba0ffb6b8
- SSDEEP 393216:zFeCpQ/hbBWGW1tkWSz61gUM0SOm53TgypRvlxoMtBpMw4OrsxJ9:QCpQpbQ1tBj1gR0SP53tRvlLpM2w9
- TLSH
  T19B370112BA9A546CD4BAC470935747726E3178CA1B34B9FF41C492783E79BF06B38329
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 32KB
- SHA256 657672be6ea8a72fb4765074cfda019fb8fa4eacb3238a416c186f53919d7cf4
- MD5 1f24c9859dd6639d0c752d7b96a2442d
- SHA1 7014f711d1d06cdc3d5bae678aad29e8b9ebcfd2
- SHA512 7a488b27031e76873623142e66355d45a2bcd13d0fe235b93db1f92bb5c6658c4b689131672cacdad7b5a3204fca3fdbe020066f442b3a0db17fcf85f3eabf96
- SSDEEP 384:PnpIqrPKteJM6zAzlq0BnPr681qrSYc/RHXCtk6tztN4Ykvdv7WbHwyx1I83cwTv:PpI8yU0tmC/hS3NfgvtQt28PEslxo
- TLSH
  T1FCE21A19FE42A5F6C233A5705AEBD3BBCB04B437D8234F1AEE124B4AB9675B1510D211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/StartMenu.dll
- Size 12KB
- SHA256 a75c0c6ffcfe8cf8894d2c644f74cff8da2af0dffab23782fbbb6597c1c7738b
- MD5 80db9f53cb4176c30ab415985c876a86
- SHA1 29a032cf9858b309982bc96910f66c72cc2056fe
- SHA512 8b78a31d507e1641b3cc08007a6bee9db99923178b19047b65448f7143c55074f8219a924ea4690de8625beda1b53c6b8f216734f76c669856f7d256961f77c1
- SSDEEP 192:V1BTusyjbI05hbvNuw8Ykv/RjyE+lJP93/:HyA0DJuw8Ykvtp+lJ13/
- TLSH
  T18F42C618BF4705F7E9B39534409BE7EF451BA520DA2F4E4AEB0A0A09FE77271580E342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 28KB
- SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
- MD5 81e34f1c4b04a15dbce200c52f598f67
- SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
- SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
- SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
- TLSH
  T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 7KB
- SHA256 5f55afe7117a72467fe8d51b38b2891ea3c0bf60f4bb95bc8e238e5e9aac3a0c
- MD5 06d43685a8c862d4e0f836f3aaf2bb66
- SHA1 4e3b686fe03b188d84e8547843d43f8453534967
- SHA512 9d189bda2538b52c96e8a11833344ae2f14148be5e8dad0ece42bcb3b93ae7be9352b9504a03f4d8f0ca69d317ea11248d619c27432a5e4f1340305e9ebf3b83
- SSDEEP 96:krAEHQ+FgZHgpVGuRkNB/R37RO7nsyK3gGam:GF+H/Ykv/RLROzaQm
- TLSH
  T111E1B849F73845F2D463E53080DBE22F7E5A744C5A2B1B0DFE5B2D2AB8266701C5E30A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/coreform_license_login.exe
- Size 840KB
- SHA256 e230461c7c5a636c420c192a427fee25795bbfeb7d81c60c359e4946981577ec
- MD5 8026513ebc5c21a769cd2ec1d9f4b4cd
- SHA1 33315267a6a1f984e3a53a9dbdfc288124a9c71a
- SHA512 8eb7a96fcac3efbeea927da3d6c08d79408dec72cfd8591db3d94e4af450c22b900afd9d6a300a4d08cc5b521a9723ab1cfc5919d68c4c30a5aae4c5cff5a297
- SSDEEP 12288:wPnXWuKzY3paWwwi7OSIsasl3uEUrzXYOrjB0ccPaDqMfna:wPnXWusWwRiiaU+EUrP90ccPaL
- TLSH
  T161051A16BA4E98ACC05AC07483464A336A7174CB1B3579FF41D496783E7AAF42F3D728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  $PLUGINSDIR/licensing_client.dll
- Size 3.5MB
- SHA256 9157f2ffd77dd7e7adc83cfc68ac61ea1878f79defbc11bb5c2ca3a28136e9eb
- MD5 b5f0642abe5deda87c854029354f65b8
- SHA1 a53619e7f16c0db6884cb0ff571f60ea07d1c28a
- SHA512 1f1355d84578b3d5b06f6d95a214bd3aeb040b1a8fb9ad5b7d78b9d43869b9d0327aaa82ca95baeffa4563ac8a29385647260768e277f6d6620932e8ca4d02eb
- SSDEEP 49152:p5o/Vu2VdQNloQB38+hED6MRxMd9Dpj+Vr/+73XWi9IU6iNKtJ:EM38SpjY+7K+
- TLSH
  T1A1F53912BA8A946DC0AAC074834B4B72AB7174CB0B3579FF45D492793E69BF01B3C758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 14KB
- SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
- MD5 2726673c720a296442c8ed134b41d169
- SHA1 b8050c85017fcda78f6b82cc86ad277bb0dbd539
- SHA512 95fd8cd96a4c627dfc1a89a98630ead3fe431360ab15f2324a52fdd03b2b493bdc44a4d6d0189276826725ea4e48aeb4711459a459b92a80be51e9431b70bb0b
- SSDEEP 192:clWWck581HwPRLG/CocFR1w5nEYkv/RGl5BoiS+6SZSM3CU:Hdk5SoRLG/CocFR62Ykv8l5BoiFXyU
- TLSH
  T16252E50EFB0A44F6C572D834548BE72F869DA415C66F4E0AEF170B0CBDA32B5280E346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/vc_redist.x64.exe
- Size 17.9MB
- SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
- MD5 8da7373f3ec287fe1c3ad72a7b2922f0
- SHA1 46adcdfbe9aebe767657b7a802cc366f827ced77
- SHA512 c42c82cfd5eaa2165b600f6109cb14ff4308cdf4cff656a1375b4a933f1630bfe54c99c4d0fb9ed3bea4dc4e4fdaa3db8e7c58356cca07c2954f4c297757d62d
- SSDEEP 393216:rCpQ/hbBWGW1tkWSz61gUM0SOm53TgypRvlxoMtBpMw4OrW:rCpQpbQ1tBj1gR0SP53tRvlLpM2K
- TLSH
  T133173332A4742132F6F16437F968F1307E3CA72863D09D99D3C8AD99396488267F725B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  Uninstall.exe
- Size 277KB
- SHA256 d81398215ec422e0cea78305f4cf997cf6d0ecda7f0730a03566f6680e446a32
- MD5 60a48e9f8d37575bcb59e214987cda1b
- SHA1 4571a3a679f82b4291910a1c285769289b6582c3
- SHA512 fd5a2340b06eb41a5ffd89989cc4420a81fa801f35aab4c91362763f405bf6d7f60f6379edc4bc9d7be398a38a33683f487dba076cc691a5bef6d20dc32812ce
- SSDEEP 3072:7+82pt56X6YQrTz98xQT+5U5qXHceAWI95e1HNdD/cWwawDRO2SOxHJMxFMSRi1Q:yTp7pB0PHmWU+H7DkcEAOIRqOPNz
- TLSH
  T1CC540806A7FE8565F5F35B31AEB792D20A36BC616E39C10E6701691D4C35BA0FA60333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
behavioral19 behavioral20
- Target
  $PLUGINSDIR/UserInfo.dll
- Size 7KB
- SHA256 5f55afe7117a72467fe8d51b38b2891ea3c0bf60f4bb95bc8e238e5e9aac3a0c
- MD5 06d43685a8c862d4e0f836f3aaf2bb66
- SHA1 4e3b686fe03b188d84e8547843d43f8453534967
- SHA512 9d189bda2538b52c96e8a11833344ae2f14148be5e8dad0ece42bcb3b93ae7be9352b9504a03f4d8f0ca69d317ea11248d619c27432a5e4f1340305e9ebf3b83
- SSDEEP 96:krAEHQ+FgZHgpVGuRkNB/R37RO7nsyK3gGam:GF+H/Ykv/RLROzaQm
- TLSH
  T111E1B849F73845F2D463E53080DBE22F7E5A744C5A2B1B0DFE5B2D2AB8266701C5E30A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

defense_evasiondiscovery

behavioral20

defense_evasiondiscovery

behavioral21

behavioral22

© 2018-2026

Terms | Privacy