General
- Target 2026-04-25_053a91731ceb485cd1d1b4459536d672_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_remcos_vidar_wannacry
- Size 14.2MB
- Sample260425-spm4sscs5x
- SHA256 cee854a8a551eed6821d4d0cc6a768fb3b026ceb78a99a37c0a24298e10beba3
- MD5 053a91731ceb485cd1d1b4459536d672
- SHA1 4ede168888ce3f87dde85a59e06ff8009ea68dc6
- SHA512 4894556f4bbccc411e8ca7d74a8bfd8434bd09a14581234c8344d2cd7c03fd7ea94a810c8cc5026e080cea18ca44508fe5e508ece29f3da59c9aa9fda7e794bf
- SSDEEP 98304:Pe5x6c1/e5x6c1ze5x6c1/e5x6c1Mz+oq2Vjnm0e5x6c1/e5x6c1ze5x6c1/e5xB:IkQkjGn2kQkjGnq
- TLSH T102E69E06B69480F5D2A6863055BA9777F771B8054B30DBDF8364CA2D2E337C09E3A366
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-25_053a91731ceb485cd1d1b4459536d672_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win10v2004-20260130-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-25_053a91731ceb485cd1d1b4459536d672_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win11-20260130-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-25_053a91731ceb485cd1d1b4459536d672_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_remcos_vidar_wannacry
- Size 14.2MB
- SHA256 cee854a8a551eed6821d4d0cc6a768fb3b026ceb78a99a37c0a24298e10beba3
- MD5 053a91731ceb485cd1d1b4459536d672
- SHA1 4ede168888ce3f87dde85a59e06ff8009ea68dc6
- SHA512 4894556f4bbccc411e8ca7d74a8bfd8434bd09a14581234c8344d2cd7c03fd7ea94a810c8cc5026e080cea18ca44508fe5e508ece29f3da59c9aa9fda7e794bf
- SSDEEP 98304:Pe5x6c1/e5x6c1ze5x6c1/e5x6c1Mz+oq2Vjnm0e5x6c1/e5x6c1ze5x6c1/e5xB:IkQkjGn2kQkjGnq
- TLSH T102E69E06B69480F5D2A6863055BA9777F771B8054B30DBDF8364CA2D2E337C09E3A366
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry