General
- Target 2026-05-05_12ae15201039dc0877bc2f35a08c046a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_stealc_vidar_wannacry
- Size 36.9MB
- Sample260505-ryrmxaas2t
- SHA256 bfb2d9c1760ee67a43bec200fd040f12ee00726143463136a010885b5ca936c1
- MD5 12ae15201039dc0877bc2f35a08c046a
- SHA1 c654c7b6cd701e23a8e6cba0f4ae869b89f0bb07
- SHA512 58652fdac2ecb8055893d43c3d532cd9666b4d1db3018306e4e76d472ebccf9451aea5b2f55b97dfd3367db7c6551c81f8d3e3e23d84571c8e2a0603ed550e36
- SSDEEP 393216:yvyEYKbayZ/K0ttYZT1EU8IBJcPvyEYKbayZ/K0ttYZT1EU8IBJcr:W4yZ/K0ttYZT1zcn4yZ/K0ttYZT1zcr
- TLSH T1CF878C12B6E440F5D1AA9134CE269232E7B2BC164BF197DB1250FAD92F336D07E39316
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-05_12ae15201039dc0877bc2f35a08c046a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
Resource
win10v2004-20260130-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-05_12ae15201039dc0877bc2f35a08c046a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hij.exe
Resource
win11-20260130-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-05_12ae15201039dc0877bc2f35a08c046a_amadey_cobalt-strike_coinminer_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_stealc_vidar_wannacry
- Size 36.9MB
- SHA256 bfb2d9c1760ee67a43bec200fd040f12ee00726143463136a010885b5ca936c1
- MD5 12ae15201039dc0877bc2f35a08c046a
- SHA1 c654c7b6cd701e23a8e6cba0f4ae869b89f0bb07
- SHA512 58652fdac2ecb8055893d43c3d532cd9666b4d1db3018306e4e76d472ebccf9451aea5b2f55b97dfd3367db7c6551c81f8d3e3e23d84571c8e2a0603ed550e36
- SSDEEP 393216:yvyEYKbayZ/K0ttYZT1EU8IBJcPvyEYKbayZ/K0ttYZT1EU8IBJcr:W4yZ/K0ttYZT1zcn4yZ/K0ttYZT1zcr
- TLSH T1CF878C12B6E440F5D1AA9134CE269232E7B2BC164BF197DB1250FAD92F336D07E39316
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry