General
- Target 2026-04-15_b0e8c82e8ec6e342e81d901c40ac5143_cobalt-strike_darkgate_elex_glassworm_hijackloader_rhadamanthys_smoke-loader_stop_vidar
- Size 9.8MB
- Sample260415-t45stsd14k
- SHA256 a66886594451d81fcfd1aa749be2ce7e7994945d34c19a2f6ed992361de57750
- MD5 b0e8c82e8ec6e342e81d901c40ac5143
- SHA1 ca9026c563737205083b9e0f7f0b7d5d34e8c33b
- SHA512 ce05dcf270f2b0fed7d311704e67643ab63601f69537a40381be46e5c0861716f9234ba75aead7c5857603b34cd0b2ae8982dd0b9b934df715dd7b22226ad340
- SSDEEP 49152:JxpM84pkc8MNFvgA0vbGAIiIrdGU1T3S9tsgX8zEC8ULgCSA/Bkj06:OfkchgAOSJdT1TIOSAA
- TLSH T15BA6700B6A7CED22F52E3DB5D864C6F80A183DA94953742538F4BE9ED6336C17E09231
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-04-15_b0e8c82e8ec6e342e81d901c40ac5143_cobalt-strike_darkgate_elex_glassworm_hijackloader_rhada.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-15_b0e8c82e8ec6e342e81d901c40ac5143_cobalt-strike_darkgate_elex_glassworm_hijackloader_rhadamanthys_smoke-loader_stop_vidar
- Size 9.8MB
- SHA256 a66886594451d81fcfd1aa749be2ce7e7994945d34c19a2f6ed992361de57750
- MD5 b0e8c82e8ec6e342e81d901c40ac5143
- SHA1 ca9026c563737205083b9e0f7f0b7d5d34e8c33b
- SHA512 ce05dcf270f2b0fed7d311704e67643ab63601f69537a40381be46e5c0861716f9234ba75aead7c5857603b34cd0b2ae8982dd0b9b934df715dd7b22226ad340
- SSDEEP 49152:JxpM84pkc8MNFvgA0vbGAIiIrdGU1T3S9tsgX8zEC8ULgCSA/Bkj06:OfkchgAOSJdT1TIOSAA
- TLSH T15BA6700B6A7CED22F52E3DB5D864C6F80A183DA94953742538F4BE9ED6336C17E09231
- MD5 SHA1 SHA512 SSDEEP TLSH
- Custom signature
Detects executables containing URLs to raw contents of a Github gist
- Custom signature
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Drops file in System32 directory