General
- Target 2026-06-28_27e57fc65cc48fd24a724e0ac2ae48e9_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 4.1MB
- Sample260628-3rx2wshv6m
- SHA256 3bf64071686bd39dc6bfc403b3d1979ced705d58a3a65e3b4f6929ce707d0c9b
- MD5 27e57fc65cc48fd24a724e0ac2ae48e9
- SHA1 b75d98a3bf82ac03afa8e18d9a901bc06c966ab5
- SHA512 31d00bc2df7d22cd75dc198e72268ae84f06c951be6d26e26e561cd1deb43d1286b703e6bb8f2c92d46a4b2cc07528d331c9d2908fd2b32bc39ce9aef343bfd0
- SSDEEP 49152:A3kMPljHeW4SkZP4sz9Mb5eW4SkZP4sz9Mbd56rbeW4SkZP4sz9MbE56rtTe:A3kM5fkZcNfkZcer7fkZcBrtT
- TLSH T16A161916F6788723D0B7C0B9C5D6AA5AFA3338455F308BCB0245DB2C2E276D19A35736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-06-28_27e57fc65cc48fd24a724e0ac2ae48e9_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_27e57fc65cc48fd24a724e0ac2ae48e9_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260618-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_27e57fc65cc48fd24a724e0ac2ae48e9_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 4.1MB
- SHA256 3bf64071686bd39dc6bfc403b3d1979ced705d58a3a65e3b4f6929ce707d0c9b
- MD5 27e57fc65cc48fd24a724e0ac2ae48e9
- SHA1 b75d98a3bf82ac03afa8e18d9a901bc06c966ab5
- SHA512 31d00bc2df7d22cd75dc198e72268ae84f06c951be6d26e26e561cd1deb43d1286b703e6bb8f2c92d46a4b2cc07528d331c9d2908fd2b32bc39ce9aef343bfd0
- SSDEEP 49152:A3kMPljHeW4SkZP4sz9Mb5eW4SkZP4sz9Mbd56rbeW4SkZP4sz9MbE56rtTe:A3kM5fkZcNfkZcer7fkZcBrtT
- TLSH T16A161916F6788723D0B7C0B9C5D6AA5AFA3338455F308BCB0245DB2C2E276D19A35736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory