General
- Target 2026-06-04_565a804cfa52e68046677423c4d83650_cobalt-strike_conti_darkgate_elex_gcleaner_hijackloader_swisyn
- Size 713KB
- Sample260604-by65lagv4t
- SHA256 4499519f59e4dad8cc12b737ba235fccdd3dc41615ca52339a0fc25ee1c07360
- MD5 565a804cfa52e68046677423c4d83650
- SHA1 6cf40486ee4954a5ded4b2fc83c9371cb3c6e3c2
- SHA512 b73619707ced9dec7798e11468f48b128826a462a39dccbb075b6fc490b10bf417531fb58d8807ec137b02c56cc971bfee9fb1b2012e1df7254b3e8d506605b1
- SSDEEP 12288:PFUNDas9hQqoui8o4+KfHMUoKp+HRNwMi3h0PVm5R888888888888W888888888f:PFOaQjourn+KfHMGizS0PVDu
- TLSH T1D5F47D23B7D14537E1261A799C6A9694BC297E202FE0DC4B3FF4EE4C1A787423839257
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-04_565a804cfa52e68046677423c4d83650_cobalt-strike_conti_darkgate_elex_gcleaner_hijackloader_swisyn.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_565a804cfa52e68046677423c4d83650_cobalt-strike_conti_darkgate_elex_gcleaner_hijackloader_swisyn.exe
Resource
win11-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-04_565a804cfa52e68046677423c4d83650_cobalt-strike_conti_darkgate_elex_gcleaner_hijackloader_swisyn
- Size 713KB
- SHA256 4499519f59e4dad8cc12b737ba235fccdd3dc41615ca52339a0fc25ee1c07360
- MD5 565a804cfa52e68046677423c4d83650
- SHA1 6cf40486ee4954a5ded4b2fc83c9371cb3c6e3c2
- SHA512 b73619707ced9dec7798e11468f48b128826a462a39dccbb075b6fc490b10bf417531fb58d8807ec137b02c56cc971bfee9fb1b2012e1df7254b3e8d506605b1
- SSDEEP 12288:PFUNDas9hQqoui8o4+KfHMUoKp+HRNwMi3h0PVm5R888888888888W888888888f:PFOaQjourn+KfHMGizS0PVDu
- TLSH T1D5F47D23B7D14537E1261A799C6A9694BC297E202FE0DC4B3FF4EE4C1A787423839257
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory