32d0be66a2de2420d686a671dacff519377278664352a8401826ff526988ff48

General

Target
2026-11-09_9ad459ec1ecb95ae828d62a609f772ee_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_stealc_vidar
Size 10.3MB
Sample261110-pfty7sav6w
SHA256 32d0be66a2de2420d686a671dacff519377278664352a8401826ff526988ff48
MD5 9ad459ec1ecb95ae828d62a609f772ee
SHA1 9da1c9878198864b11d4623af2ee34ead9981959
SHA512 f7801d0942f3893ae47ec31f3b91ef4a052b98fe19c08fd80e328ccd427496efd076ef0e0ee58c145d31e67fec9dc23458600c077413c5e34e97139b8b2c9275
SSDEEP 196608:jc0v+SJlIIQygMiBNfi6bvjML0g1OXCn9ez+k4xG/:jsbvjs0cOynYzqxi
TLSH
T1D8B6950267FC0404F5F3AB799A3988618A37BD762F34E59E11582C5D0B73E928D72B72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-09_9ad459ec1ecb95ae828d62a609f772ee_amadey_cobalt-strike_darkgate_glassworm_icedid_luca-stealer_njrat_stealc_vidar
- Size 10.3MB
- SHA256 32d0be66a2de2420d686a671dacff519377278664352a8401826ff526988ff48
- MD5 9ad459ec1ecb95ae828d62a609f772ee
- SHA1 9da1c9878198864b11d4623af2ee34ead9981959
- SHA512 f7801d0942f3893ae47ec31f3b91ef4a052b98fe19c08fd80e328ccd427496efd076ef0e0ee58c145d31e67fec9dc23458600c077413c5e34e97139b8b2c9275
- SSDEEP 196608:jc0v+SJlIIQygMiBNfi6bvjML0g1OXCn9ez+k4xG/:jsbvjs0cOynYzqxi
- TLSH
  T1D8B6950267FC0404F5F3AB799A3988618A37BD762F34E59E11582C5D0B73E928D72B72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution macro persistence ransomware spyware stealer upx
- Custom signature
  
  Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Custom signature
  
  detects Windows exceutables potentially bypassing UAC using eventvwr.exe
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Suspicious Office macro
  Office document equipped with macros.
  macro
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2