General
- Target 2026-06-28_11f34838c78bb25fa724b6c7a337ac52_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hijackloader_icedid_luca-stealer_njrat_poet-rat_satacom_vidar_wannacry
- Size 6.3MB
- Sample260629-anyvsshv7v
- SHA256 88df904efe560baddccda4cd40c61660a00c6539266eea90e38f4deec1bfe0b4
- MD5 11f34838c78bb25fa724b6c7a337ac52
- SHA1 69e3011e03e1344c2bb0c6592b8b7e068cad2d93
- SHA512 addf314bcbbf4dd1d762a47453803452453cb159c32592d3400c405622d8d3f3841fc3d848cf81db59553fdde84a0d8d1b1ebff2571023f5b7ef0cfc39ea1d6b
- SSDEEP 98304:nn7ON5pvwOhg5+tats/fh6ImzzJoDfuBcMv+A73XA:nnSN5pvwO+5+tatsHh6ImzD+F
- TLSH T120667C51FA9B68F1D6034530457792AF6730B9048322CFCBD640BF9AFE676D26D36222
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-06-28_11f34838c78bb25fa724b6c7a337ac52_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glasswo.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_11f34838c78bb25fa724b6c7a337ac52_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glasswo.exe
Resource
win11ltsc2024-20260617-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_11f34838c78bb25fa724b6c7a337ac52_amadey_cobalt-strike_coinminer_cryptbot_darkgate_glassworm_hijackloader_icedid_luca-stealer_njrat_poet-rat_satacom_vidar_wannacry
- Size 6.3MB
- SHA256 88df904efe560baddccda4cd40c61660a00c6539266eea90e38f4deec1bfe0b4
- MD5 11f34838c78bb25fa724b6c7a337ac52
- SHA1 69e3011e03e1344c2bb0c6592b8b7e068cad2d93
- SHA512 addf314bcbbf4dd1d762a47453803452453cb159c32592d3400c405622d8d3f3841fc3d848cf81db59553fdde84a0d8d1b1ebff2571023f5b7ef0cfc39ea1d6b
- SSDEEP 98304:nn7ON5pvwOhg5+tats/fh6ImzzJoDfuBcMv+A73XA:nnSN5pvwO+5+tatsHh6ImzD+F
- TLSH T120667C51FA9B68F1D6034530457792AF6730B9048322CFCBD640BF9AFE676D26D36222
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.