General
- Target 2026-06-04_d329387d8ee2e392061b1b15915647ea_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_stealc_vidar_wannacry
- Size 8.6MB
- Sample260604-yl22fadv5t
- SHA256 f650f8a5596a761e2927e23959b98d589bca8d217a9dfb60560af058d1767c10
- MD5 d329387d8ee2e392061b1b15915647ea
- SHA1 262adfa2aa004a2dcbb08aa4e1a35c097c1f0885
- SHA512 8dfffaeb651a67286e24918fb1451ffb23f052c0593f7269b3537a02a2b95e4ee18bd301ba3a37569d2b67144d1e6033d6f14d5a5ae25a46b523a22d0d6486ce
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRH3DgdeRu:8pAnjOyAdOrNTfgd7ozN3cdek
- TLSH T1FE967B16B3A44237E0B7927AC0B51B69D671783A5B32C3CF7244B65E1E637C28937722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-06-04_d329387d8ee2e392061b1b15915647ea_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_d329387d8ee2e392061b1b15915647ea_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11-20260513-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-04_d329387d8ee2e392061b1b15915647ea_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_stealc_vidar_wannacry
- Size 8.6MB
- SHA256 f650f8a5596a761e2927e23959b98d589bca8d217a9dfb60560af058d1767c10
- MD5 d329387d8ee2e392061b1b15915647ea
- SHA1 262adfa2aa004a2dcbb08aa4e1a35c097c1f0885
- SHA512 8dfffaeb651a67286e24918fb1451ffb23f052c0593f7269b3537a02a2b95e4ee18bd301ba3a37569d2b67144d1e6033d6f14d5a5ae25a46b523a22d0d6486ce
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRH3DgdeRu:8pAnjOyAdOrNTfgd7ozN3cdek
- TLSH T1FE967B16B3A44237E0B7927AC0B51B69D671783A5B32C3CF7244B65E1E637C28937722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Drops file in System32 directory