Overview

overview

10

Static

static

10

2026-11-10...ha.exe

windows10-2004-x64

10

2026-11-10...ha.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rhadamanthys_rusty-stealer_satacom_vidar
  • Size 2.9MB
  • Sample261110-fxbphstx7m
  • SHA256 d83fbe4d4d7fd5f6c4b3200b0ef310293ba250d3ee7fe0f6003c8b3c15a359e0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
godpotatodefense_evasiondiscoveryexecutionhacktoolpersistenceprivilege_escalation

Malware Config

Targets

    • Target
      2026-11-10_d33687648d316587f834e273b29f2d3d_akira_cobalt-strike_glassworm_hacktools_icedid_njrat_rhadamanthys_rusty-stealer_satacom_vidar
    • Size 2.9MB
    • SHA256 d83fbe4d4d7fd5f6c4b3200b0ef310293ba250d3ee7fe0f6003c8b3c15a359e0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutiongodpotatohacktoolpersistenceprivilege_escalation

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detects GodPotato

      hacktool

    • Family: GodPotato

      GodPotato is an open-source privilege escalation tool written in C#.

      hacktoolgodpotato
    • Custom signature

      Detects executables containing artifacts associated with disabling Widnows Defender

    • Custom signature

      Detects executables embedding registry key / value combination indicative of disabling Windows Defen

    • Modifies Windows Firewall

      defense_evasion

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      defense_evasion

    • Creates new service(s)

      persistenceexecution

    • Executes dropped EXE

    • Stops running service(s)

      defense_evasionexecution

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

Windows Command Shell

1
T1059.003

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Network Service Discovery

1
T1046

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

1
T1016.001

System Service Discovery

1
T1007

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks