acfa400b2349783767e34a39f0e31a381bf07c7deffdd17028c3cb9e1e61552c

General

Target
2026-11-09_63354e985fa76bccdced6f4d703eb530_amadey_cryptbot_elex_luca-stealer_lynx_njrat
Size 12.0MB
Sample261110-wez76act2x
SHA256 acfa400b2349783767e34a39f0e31a381bf07c7deffdd17028c3cb9e1e61552c
MD5 63354e985fa76bccdced6f4d703eb530
SHA1 d1b7f8e6f35b48342000d5039ffd8a16b1938abb
SHA512 53eaeda00b3f1327c8a68f724dc802460f3e0b9f54c0023d02e679a098cc43ccd4f3da176109d5044a072e9884b91f75d677fc95e4d843ffacf32fad90a0a776
SSDEEP 196608:TRy34+425Z9kUcrAhgqWXu5stMKBCHb5sURaJYj4eg2dGyTxfS4KXcVtF6QtQwhm:Tw425orAhvWXu5dT75hRaJYj4r2Xq4Kb
TLSH
T13FC63310F7499E73C65009309A7993697ABDAA311F3087DB43E006BD1D785E2A63BB1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-11-09_63354e985fa76bccdced6f4d703eb530_amadey_cryptbot_elex_luca-stealer_lynx_njrat
- Size 12.0MB
- SHA256 acfa400b2349783767e34a39f0e31a381bf07c7deffdd17028c3cb9e1e61552c
- MD5 63354e985fa76bccdced6f4d703eb530
- SHA1 d1b7f8e6f35b48342000d5039ffd8a16b1938abb
- SHA512 53eaeda00b3f1327c8a68f724dc802460f3e0b9f54c0023d02e679a098cc43ccd4f3da176109d5044a072e9884b91f75d677fc95e4d843ffacf32fad90a0a776
- SSDEEP 196608:TRy34+425Z9kUcrAhgqWXu5stMKBCHb5sURaJYj4eg2dGyTxfS4KXcVtF6QtQwhm:Tw425orAhvWXu5dT75hRaJYj4r2Xq4Kb
- TLSH
  T13FC63310F7499E73C65009309A7993697ABDAA311F3087DB43E006BD1D785E2A63BB1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

adware defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Custom signature
  
  Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Custom signature
  
  Detects executables built or packed with MPress PE compressor
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Blocks application from running via registry modification
  Adds application to list of disallowed applications.
  defense_evasion
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Disables cmd.exe use via registry modification
  defense_evasion
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2