fesber | 742514e07f9c0ecb1d7374b395c3a3b54ec92d1f9a0c9d92d522403c599a1758

General

Target
2026-10-03_2fbcf77f80798e099af7bef85ea6e081_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_stealc_vidar_wannacry
Size 10.4MB
Sample261004-sym56a1ejh
SHA256 742514e07f9c0ecb1d7374b395c3a3b54ec92d1f9a0c9d92d522403c599a1758
MD5 2fbcf77f80798e099af7bef85ea6e081
SHA1 bbc5d79441800f2cf1d024c867dde6e67895a266
SHA512 cd9d51faf565c779844e3dcfe67d5d3b96177ddddd8d95b18f42f87448a50075241aebdaa4d962727f3766541024e391af5b28c7f141835a6608f89ad1cc5ce3
SSDEEP 98304:xRPRRdmTIOSAk+d8MUSXIYa3Y4zhq9ceq9+2xl/SSay:xFRnmTfgEU8IBtzhWqQI0py
TLSH
T186B68D13B2E801D9E06ED27CC5714636E7B1BC269B3197CF26507A691EB3BD04E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-03_2fbcf77f80798e099af7bef85ea6e081_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_stealc_vidar_wannacry
- Size 10.4MB
- SHA256 742514e07f9c0ecb1d7374b395c3a3b54ec92d1f9a0c9d92d522403c599a1758
- MD5 2fbcf77f80798e099af7bef85ea6e081
- SHA1 bbc5d79441800f2cf1d024c867dde6e67895a266
- SHA512 cd9d51faf565c779844e3dcfe67d5d3b96177ddddd8d95b18f42f87448a50075241aebdaa4d962727f3766541024e391af5b28c7f141835a6608f89ad1cc5ce3
- SSDEEP 98304:xRPRRdmTIOSAk+d8MUSXIYa3Y4zhq9ceq9+2xl/SSay:xFRnmTfgEU8IBtzhWqQI0py
- TLSH
  T186B68D13B2E801D9E06ED27CC5714636E7B1BC269B3197CF26507A691EB3BD04E3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery fesber persistence spyware stealer upx worm
- Detects Fesber payload
- Family: Fesber
  Fesber is a Windows worm written in Delphi.
  worm fesber
- Modifies WinLogon for persistence
  persistence
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2