General
- Target 2026-04-19_1bb10c01f7264e649a99c9ce1678a194_amadey_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stop_wannacry
- Size 5.0MB
- Sample260419-2pgfpabw9j
- SHA256 fe182aab2d55da44d54322bf2f67d9e3b74e23bbcfe673cf2749c6f3322444f4
- MD5 1bb10c01f7264e649a99c9ce1678a194
- SHA1 a029a682b54eae91739cefb9fc50bf123404b0aa
- SHA512 78a8b7251264fee3d0941ccc776d282ac8ba815fd7028be12bbea93e1f8d39f74e7153b8397bc7b691d4c5d855c67453f954a065448e124b7e8698a5367c7202
- SSDEEP 98304:LSERbqSERbwp7m1SO9n7OmFOU/jIEeQfoR/IuOFVjUu5m:fm59nSmFFIF0wuQ
- TLSH T12D366B117A918032E1B219314969922D5679B861CB334EDB738C1EEEFFF05C19E36B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-19_1bb10c01f7264e649a99c9ce1678a194_amadey_cobalt-strike_coinminer_glassworm_hijackloader_ic.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-19_1bb10c01f7264e649a99c9ce1678a194_amadey_cobalt-strike_coinminer_glassworm_hijackloader_ic.exe
Resource
win11-20260130-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-19_1bb10c01f7264e649a99c9ce1678a194_amadey_cobalt-strike_coinminer_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_satacom_smoke-loader_stop_wannacry
- Size 5.0MB
- SHA256 fe182aab2d55da44d54322bf2f67d9e3b74e23bbcfe673cf2749c6f3322444f4
- MD5 1bb10c01f7264e649a99c9ce1678a194
- SHA1 a029a682b54eae91739cefb9fc50bf123404b0aa
- SHA512 78a8b7251264fee3d0941ccc776d282ac8ba815fd7028be12bbea93e1f8d39f74e7153b8397bc7b691d4c5d855c67453f954a065448e124b7e8698a5367c7202
- SSDEEP 98304:LSERbqSERbwp7m1SO9n7OmFOU/jIEeQfoR/IuOFVjUu5m:fm59nSmFFIF0wuQ
- TLSH T12D366B117A918032E1B219314969922D5679B861CB334EDB738C1EEEFFF05C19E36B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.