General
- Target 2026-04-15_35e41d3f78e11a3edcf92cc5fd0b742b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_remcos_vidar_wannacry
- Size 36.1MB
- Sample260415-3mcv6aev3y
- SHA256 6259001256ce89b6036df7f6dbb9e95a203bd95abf25d226e179400f97aa0710
- MD5 35e41d3f78e11a3edcf92cc5fd0b742b
- SHA1 44cc729a1f5c76d64a8f8d4cf5238d2f2f4918fe
- SHA512 384f921bbb20379a14f849e07f4182218c87fd06d2bd9737a5140e63c32ededd422fe69b15cf23d9d96cf1724ec8bb4d42050fef61f479fedc0f21be89ab1e2b
- SSDEEP 196608:IkopGnlkopGnPkopGnlkopOkopGnlkopGnPkopGnlkops:UGnG9GneGnG9Gns
- TLSH T152877D16B6A880F5D2B6963445A79637F731BC054B309BDF9364CA1D2E336D0EE3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_35e41d3f78e11a3edcf92cc5fd0b742b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win10v2004-20260130-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_35e41d3f78e11a3edcf92cc5fd0b742b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win11-20260130-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-15_35e41d3f78e11a3edcf92cc5fd0b742b_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_remcos_vidar_wannacry
- Size 36.1MB
- SHA256 6259001256ce89b6036df7f6dbb9e95a203bd95abf25d226e179400f97aa0710
- MD5 35e41d3f78e11a3edcf92cc5fd0b742b
- SHA1 44cc729a1f5c76d64a8f8d4cf5238d2f2f4918fe
- SHA512 384f921bbb20379a14f849e07f4182218c87fd06d2bd9737a5140e63c32ededd422fe69b15cf23d9d96cf1724ec8bb4d42050fef61f479fedc0f21be89ab1e2b
- SSDEEP 196608:IkopGnlkopGnPkopGnlkopOkopGnlkopGnPkopGnlkops:UGnG9GneGnG9Gns
- TLSH T152877D16B6A880F5D2B6963445A79637F731BC054B309BDF9364CA1D2E336D0EE3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry