7a6102ad6e6fb6eb975bc53171c7ed76aa554c063a527fd657da7134237b99bf

General

Target
2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos
Size 3.5MB
Sample261003-we3y2sterc
SHA256 7a6102ad6e6fb6eb975bc53171c7ed76aa554c063a527fd657da7134237b99bf
MD5 08fca7b860400882ff3bf1270c6eb0e2
SHA1 bbc7907aa7b57ae4ae23c2b844b6fa2345783719
SHA512 0dadc61985736351298d99fd4762c37956899f7d4d7efa25db46fda718a8ff071dd39e07f0584a3758d8c71f864c40beddce19e6552dae231dd283d7db4b340b
SSDEEP 49152:ot9XkCUCgppmTxuh61F8U1dN5gw1TYX+7eWcF/Ir9Y367:S0vuTxuhq8U1NpTM+tiUL7
TLSH
T1A406AE12E252A0E1E21F85704262173EEBF17E251B21E7DBDFD0ED652E326D1D63B209
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-02_08fca7b860400882ff3bf1270c6eb0e2_coinminer_elex_emotet_glassworm_remcos
- Size 3.5MB
- SHA256 7a6102ad6e6fb6eb975bc53171c7ed76aa554c063a527fd657da7134237b99bf
- MD5 08fca7b860400882ff3bf1270c6eb0e2
- SHA1 bbc7907aa7b57ae4ae23c2b844b6fa2345783719
- SHA512 0dadc61985736351298d99fd4762c37956899f7d4d7efa25db46fda718a8ff071dd39e07f0584a3758d8c71f864c40beddce19e6552dae231dd283d7db4b340b
- SSDEEP 49152:ot9XkCUCgppmTxuh61F8U1dN5gw1TYX+7eWcF/Ir9Y367:S0vuTxuhq8U1NpTM+tiUL7
- TLSH
  T1A406AE12E252A0E1E21F85704262173EEBF17E251B21E7DBDFD0ED652E326D1D63B209
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery evasion execution persistence privilege_escalation ransomware
- Detects executables referencing many IR and analysis tools
- Modifies boot configuration data using bcdedit
  ransomware evasion
- UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Installs a root certificate to the trusted certificate store
  A root certificate was added to the trusted certificate store using CertUtil.
  defense_evasion
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modify Registry: Disable Windows Driver Blocklist
  Disable Windows Driver Blocklist via Registry.
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Boot or Logon Autostart Execution: LSASS Driver
  Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
  persistence credential_access
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2