General
- Target 2026-06-02_676e7abf47b80cd8cb0c17d4280b22b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.8MB
- Sample260602-d9geesev6n
- SHA256 ddea9c15504af6b79b3d99ec00390ec207659a80da06c324d1ff28b2e9a99c69
- MD5 676e7abf47b80cd8cb0c17d4280b22b0
- SHA1 3f796788a8189d9fba94084a4e6d699cd60032b2
- SHA512 1840c4efb6921e9c53dd0ddd8e5505f0ec4975892b65e5589713829f86f3187d12f1df97ca1ff06802533dca141c46fe0db9f7251fd3903b102df3ee7828c704
- SSDEEP 24576:A3mnXoZjzyaEFyKUbraewsAjf3mnXoZjzyaEFyKUbraewsAju:A3kMjKPljf3kMjKPlju
- TLSH T18995B023FBB49075D17B49705B75C712A738BD610B2056CBE3A88A591F327C06F3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-06-02_676e7abf47b80cd8cb0c17d4280b22b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_676e7abf47b80cd8cb0c17d4280b22b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-02_676e7abf47b80cd8cb0c17d4280b22b0_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.8MB
- SHA256 ddea9c15504af6b79b3d99ec00390ec207659a80da06c324d1ff28b2e9a99c69
- MD5 676e7abf47b80cd8cb0c17d4280b22b0
- SHA1 3f796788a8189d9fba94084a4e6d699cd60032b2
- SHA512 1840c4efb6921e9c53dd0ddd8e5505f0ec4975892b65e5589713829f86f3187d12f1df97ca1ff06802533dca141c46fe0db9f7251fd3903b102df3ee7828c704
- SSDEEP 24576:A3mnXoZjzyaEFyKUbraewsAjf3mnXoZjzyaEFyKUbraewsAju:A3kMjKPljf3kMjKPlju
- TLSH T18995B023FBB49075D17B49705B75C712A738BD610B2056CBE3A88A591F327C06F3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detects executables packed with ASPack
Executes dropped EXE
Adds Run key to start application
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
Drops file in System32 directory