General
- Target 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar_wannacry
- Size 9.1MB
- Sample260416-pptpssat7z
- SHA256 4c36638e5208404ad068cb79582d05e057856e518e782c17e7d23f61d0e72eca
- MD5 3344800d5a81c73b666795bf848e7130
- SHA1 17196986fd165150fff6e5763b4805397a84e023
- SHA512 0b83a574a7440c2e57498b9e252854ec56af810f31a74a66dc144b7a6a4073ba261b9e5022e1c11437851faa0d95ec35f0b1b4b26ac79c89041222577b4a178d
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAP6eLapIvdVDkjol:8pAnjOyAdOrNTfL6ecIvdVSol
- TLSH T1C2A67C1272E00137D0AA917ACA65472597B13C7A8BF2C3DB7144B6D92E737C27A37722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11-20260130-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-16_3344800d5a81c73b666795bf848e7130_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar_wannacry
- Size 9.1MB
- SHA256 4c36638e5208404ad068cb79582d05e057856e518e782c17e7d23f61d0e72eca
- MD5 3344800d5a81c73b666795bf848e7130
- SHA1 17196986fd165150fff6e5763b4805397a84e023
- SHA512 0b83a574a7440c2e57498b9e252854ec56af810f31a74a66dc144b7a6a4073ba261b9e5022e1c11437851faa0d95ec35f0b1b4b26ac79c89041222577b4a178d
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAP6eLapIvdVDkjol:8pAnjOyAdOrNTfL6ecIvdVSol
- TLSH T1C2A67C1272E00137D0AA917ACA65472597B13C7A8BF2C3DB7144B6D92E737C27A37722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detects executables containing URLs to raw contents of a Github gist
- Custom signature
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Custom signature
UPX dump on OEP (original entry point)
Drops file in System32 directory