General
- Target 2026-10-13_6fb51b837b741c4f70aee8de1056f1bb_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_hive_luca-stealer_njrat_remcos_salatstealer_sliver
- Size 4.2MB
- Sample261015-nffadade33
- SHA256 ab302d30d55311bd04b82b53f55e1b1312b13e46006d6468a505820dd0e4dafc
Malware Config
Targets
-
- Target 2026-10-13_6fb51b837b741c4f70aee8de1056f1bb_amadey_cobalt-strike_darkgate_elex_frostygoop_glassworm_hive_luca-stealer_njrat_remcos_salatstealer_sliver
- Size 4.2MB
- SHA256 ab302d30d55311bd04b82b53f55e1b1312b13e46006d6468a505820dd0e4dafc
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Uses WMI to collect hardware manufacturer information
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
2Windows Management Instrumentation
2Discovery
Peripheral Device Discovery
2Query Registry
2System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Virtualization/Sandbox Evasion
1System Checks
1