General
- Target 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_stealc_vidar_wannacry
- Size 10.2MB
- Sample260420-gr18naev6w
- SHA256 f56a0b85169f2e3638aa29a3502ddeb58eb9a12d283cc49818327d0ec00bf804
- MD5 0dc714535b0c740da422768083cb076a
- SHA1 8a374b6712bc5ccc202cffc045f8956315eb0371
- SHA512 908bf2836aa92f03d798d165c5b9d97ca331a9cb436bcad863f042b4499e555cf3ed1142a35e646f60d57f01496db3ada5fec06f4ede606f3cf232d0ec566ce1
- SSDEEP 98304:lhpBinjOykGcPdOR5NTIOSAkdvjozRH3DgdiLapI0dF:TpAnjOyAdOrNTfgd7ozN3cdicI0dF
- TLSH T104B67C1273940676E0B7917AC8A54A25D7713C2A4BB1C3DF3244B6DE1E737C1AA3B722
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260130-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-20_0dc714535b0c740da422768083cb076a_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_stealc_vidar_wannacry
- Size 10.2MB
- SHA256 f56a0b85169f2e3638aa29a3502ddeb58eb9a12d283cc49818327d0ec00bf804
- MD5 0dc714535b0c740da422768083cb076a
- SHA1 8a374b6712bc5ccc202cffc045f8956315eb0371
- SHA512 908bf2836aa92f03d798d165c5b9d97ca331a9cb436bcad863f042b4499e555cf3ed1142a35e646f60d57f01496db3ada5fec06f4ede606f3cf232d0ec566ce1
- SSDEEP 98304:lhpBinjOykGcPdOR5NTIOSAkdvjozRH3DgdiLapI0dF:TpAnjOyAdOrNTfgd7ozN3cdicI0dF
- TLSH T104B67C1273940676E0B7917AC8A54A25D7713C2A4BB1C3DF3244B6DE1E737C1AA3B722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Drops file in System32 directory