General
- Target 2026-04-15_b1ac45c8fca5e7a9acc2043ae03d98b5_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_rhadamanthys_stop_vidar
- Size 11.2MB
- Sample260415-sbf4bscz2w
- SHA256 b051d6b803e355dfbfb0e711c7b43dc7807b7b8b52462695c1c29b984384e42c
- MD5 b1ac45c8fca5e7a9acc2043ae03d98b5
- SHA1 706de03477ab36ee1aa7470b7c0a3d831de76266
- SHA512 1a13efe40a7e795e22a326c06c7dbfcc312af14c2938c3f31eaed90cd3bfa933cf6745680deb6aef797996db16f0a8e0b0d0cf58256a3c54edf00b8340311e3c
- SSDEEP 49152:JxHsjfDjUx0rOO53RTqtiLdqE+XGT3S9tsgX8zEC8ULgCSA/Bkj0CeW4SkZP4szy:Xsi0rOO53rdgXGTIOSA0fkZcX
- TLSH T158C6A34B2D4CDA2AD97F3E341C50C7F999103E99692628167EC07F9EE6726C27E0D231
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-04-15_b1ac45c8fca5e7a9acc2043ae03d98b5_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-15_b1ac45c8fca5e7a9acc2043ae03d98b5_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_rhadamanthys_stop_vidar
- Size 11.2MB
- SHA256 b051d6b803e355dfbfb0e711c7b43dc7807b7b8b52462695c1c29b984384e42c
- MD5 b1ac45c8fca5e7a9acc2043ae03d98b5
- SHA1 706de03477ab36ee1aa7470b7c0a3d831de76266
- SHA512 1a13efe40a7e795e22a326c06c7dbfcc312af14c2938c3f31eaed90cd3bfa933cf6745680deb6aef797996db16f0a8e0b0d0cf58256a3c54edf00b8340311e3c
- SSDEEP 49152:JxHsjfDjUx0rOO53RTqtiLdqE+XGT3S9tsgX8zEC8ULgCSA/Bkj0CeW4SkZP4szy:Xsi0rOO53rdgXGTIOSA0fkZcX
- TLSH T158C6A34B2D4CDA2AD97F3E341C50C7F999103E99692628167EC07F9EE6726C27E0D231
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory