Bdm5-20.7z 〈Verified 2024〉

The file is heavily obfuscated and often bypasses standard YARA rules and signature-based antivirus detection during the initial stages of infection. Indicators of Compromise (IoCs) SHA-256 Hash ntstatus.exe

The file is an encrypted archive associated with a known Malware Analysis Report issued by CISA, specifically linked to the CovalentStealer malware family. Executive Summary BDM5-20.7z

1352dbb093a337eb8db9d0135adbe0542bb7e7163616e4f8962919becab171da The file is heavily obfuscated and often bypasses

An initial executable ( ntstatus.exe ) loads the encrypted data. 💡 If you have encountered this file in

💡 If you have encountered this file in your environment, it indicates a highly targeted infection. You should immediately isolate the affected machine and follow the CISA Malware Analysis guidelines for remediation.

It uses an with a hardcoded string ( hrjio2mfsdlf235d ) to process variables. The final decoded payload is typically named result.exe .

The archive contains a highly obfuscated malware sample that uses machine-specific hardware IDs to prevent independent analysis. CovalentStealer.