General
- Target 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_vidar
- Size 4.8MB
- Sample260422-wpdrxadv3j
- SHA256 68379dda23b90dcb357bf52f69714fe67353ef6a6aaea287c90d40cdc30f6e18
- MD5 f0ed86a003719e84c5d7feb8c3e2395d
- SHA1 2d46649f27c596dec546fa639ca520382d610706
- SHA512 5a8998acc9c4915fa09220081559df5891b25f1283018245397f58c5e58549d0148160e62d0bfe675cba9c4b86769c6ce8a1b4c4ddb2ff43298de56a33e8592b
- SSDEEP 98304:a4stJM9vAsNi9Xwgwfo4L9IW1dXg3S/MHmguzYcLzrX:a/vM9i9XwgwAqvLPX
- TLSH T112361781B1D68527CC6E4D7085419930F9253F9F3F2DB687EE447A29AB7F2C0A92D312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe
Resource
win10v2004-20260130-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_.exe
Resource
win11-20260130-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-22_f0ed86a003719e84c5d7feb8c3e2395d_amadey_cobalt-strike_coinminer_elex_hijackloader_icedid_luca-stealer_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_vidar
- Size 4.8MB
- SHA256 68379dda23b90dcb357bf52f69714fe67353ef6a6aaea287c90d40cdc30f6e18
- MD5 f0ed86a003719e84c5d7feb8c3e2395d
- SHA1 2d46649f27c596dec546fa639ca520382d610706
- SHA512 5a8998acc9c4915fa09220081559df5891b25f1283018245397f58c5e58549d0148160e62d0bfe675cba9c4b86769c6ce8a1b4c4ddb2ff43298de56a33e8592b
- SSDEEP 98304:a4stJM9vAsNi9Xwgwfo4L9IW1dXg3S/MHmguzYcLzrX:a/vM9i9XwgwAqvLPX
- TLSH T112361781B1D68527CC6E4D7085419930F9253F9F3F2DB687EE447A29AB7F2C0A92D312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory