payload_ransomware | 730c9dd15dfb611a501e58ff735480e687ca0c8695682d154c0443d97dcddbc3

General

Target
2026-10-13_6025def74c0b85f355485bb0be6fb13d_amadey_cobalt-strike_darkgate_elex_medusalocker_smoke-loader
Size 669KB
Sample261015-ppcraat1es
SHA256 730c9dd15dfb611a501e58ff735480e687ca0c8695682d154c0443d97dcddbc3
MD5 6025def74c0b85f355485bb0be6fb13d
SHA1 df45e6ef4771263a8454b7af10ea68a25a2ee615
SHA512 47235c712dac03232d6160d51be25c558bb82cafa05789bdcb554e39e41c8b3b4ad0f770a63643b23b58e0868608874420576ba5550096ed82d9ddb5799fe104
SSDEEP 12288:jtG7v58BCmzlQIBAjs9mbiEE3P5Hk3cVOWMD8I20jE:joz5wCqFmsWibP5Hk3cEWMDd
TLSH
T1B5E4E49F7363BC6BC012133DA964FE7449B967DC856763B622F83D2F3920171942362A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-13_6025def74c0b85f355485bb0be6fb13d_amadey_cobalt-strike_darkgate_elex_medusalocker_smoke-loader
- Size 669KB
- SHA256 730c9dd15dfb611a501e58ff735480e687ca0c8695682d154c0443d97dcddbc3
- MD5 6025def74c0b85f355485bb0be6fb13d
- SHA1 df45e6ef4771263a8454b7af10ea68a25a2ee615
- SHA512 47235c712dac03232d6160d51be25c558bb82cafa05789bdcb554e39e41c8b3b4ad0f770a63643b23b58e0868608874420576ba5550096ed82d9ddb5799fe104
- SSDEEP 12288:jtG7v58BCmzlQIBAjs9mbiEE3P5Hk3cVOWMD8I20jE:joz5wCqFmsWibP5Hk3cEWMDd
- TLSH
  T1B5E4E49F7363BC6BC012133DA964FE7449B967DC856763B622F83D2F3920171942362A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution payload_ransomware impact ransomware
- Detects Payload Ransomware
- Family: Payload
  Payload is a cross-platform ransomware first seen in February 2026.
  ransomware payload_ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detects command variations typically used by ransomware
- Detects executables containing many references to VEEAM. Observed in ransomware
- Renames multiple (4952) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2