General
- Target 2026-05-22_0b6a4d4d58d14b036346c4668fc546a9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_stealc_vidar
- Size 17.4MB
- Sample260522-s963eaay41
- SHA256 287aead4353dc829fed8f991330164bdd3e6f898e2f010b12c021db9eae8dbba
- MD5 0b6a4d4d58d14b036346c4668fc546a9
- SHA1 1cc4da030f70300101c71847d176574a41aff1ca
- SHA512 71c4cbc33083966d9c399918440c5b0010f0934761051c2d64dbd69d8cef269d4a34ccac3a807386d2f7a9a922b061465229246c7c0921e6215de3d1b705fce1
- SSDEEP 196608:l8Vb618U68Vb618U7/h1+TO8Vb618U68Vb618U7/h1+T/WqQI0py+:2cDcQcDcUWqQjp3
- TLSH T171078D13F6A840E5E07AD57486A69732EA727C524B319ACF0354F7192F33AD05F3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-22_0b6a4d4d58d14b036346c4668fc546a9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_0b6a4d4d58d14b036346c4668fc546a9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Resource
win11-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-22_0b6a4d4d58d14b036346c4668fc546a9_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_stealc_vidar
- Size 17.4MB
- SHA256 287aead4353dc829fed8f991330164bdd3e6f898e2f010b12c021db9eae8dbba
- MD5 0b6a4d4d58d14b036346c4668fc546a9
- SHA1 1cc4da030f70300101c71847d176574a41aff1ca
- SHA512 71c4cbc33083966d9c399918440c5b0010f0934761051c2d64dbd69d8cef269d4a34ccac3a807386d2f7a9a922b061465229246c7c0921e6215de3d1b705fce1
- SSDEEP 196608:l8Vb618U68Vb618U7/h1+TO8Vb618U68Vb618U7/h1+T/WqQI0py+:2cDcQcDcUWqQjp3
- TLSH T171078D13F6A840E5E07AD57486A69732EA727C524B319ACF0354F7192F33AD05F3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry