General
- Target 2026-05-31_04861c9fd87f37493d840508f63048ad_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry
- Size 22.9MB
- Sample260531-krnjcaft3n
- SHA256 a7e9fffa7f008ac2e95bd0753036b50d0f061695fcfdb5bd9a55bd9ee4663a8b
- MD5 04861c9fd87f37493d840508f63048ad
- SHA1 c38aceb5d3f20cbe8a93dc5bd58a21f278d67cfd
- SHA512 b7734281fc2518b52c10d1ddbcb70faa4769b9699a0011e62fc89fc5e4ed98a21f8b83084ef54595c5d665da419e70b7242a0c6eeaa2ea6bc8f490f036195732
- SSDEEP 196608:l8Vb618U68Vb618Ul8Vb618U68Vb618UCi8Vb618U68Vb618Ul8Vb618U68Vb61e:2cDcKcDcO3cDcKcDcOZ
- TLSH T100377B17E69444F5D16E99308B658232EA73BC120B7197CB43A0F62D2F336D06F7A726
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-31_04861c9fd87f37493d840508f63048ad_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-31_04861c9fd87f37493d840508f63048ad_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win11-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-31_04861c9fd87f37493d840508f63048ad_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry
- Size 22.9MB
- SHA256 a7e9fffa7f008ac2e95bd0753036b50d0f061695fcfdb5bd9a55bd9ee4663a8b
- MD5 04861c9fd87f37493d840508f63048ad
- SHA1 c38aceb5d3f20cbe8a93dc5bd58a21f278d67cfd
- SHA512 b7734281fc2518b52c10d1ddbcb70faa4769b9699a0011e62fc89fc5e4ed98a21f8b83084ef54595c5d665da419e70b7242a0c6eeaa2ea6bc8f490f036195732
- SSDEEP 196608:l8Vb618U68Vb618Ul8Vb618U68Vb618UCi8Vb618U68Vb618Ul8Vb618U68Vb61e:2cDcKcDcO3cDcKcDcOZ
- TLSH T100377B17E69444F5D16E99308B658232EA73BC120B7197CB43A0F62D2F336D06F7A726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry