General
- Target 2026-06-27_ded6037a08c67928b0336fda652bb2c7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar_wannacry
- Size 8.7MB
- Sample260629-ckjmtaaz4x
- SHA256 7e3b51f4305ff14042dea03bcc8ca8e70f447b58f30333ded54f7a21f187fabd
- MD5 ded6037a08c67928b0336fda652bb2c7
- SHA1 acef32ee844f2f344df20fc8cb3bf7c43cb65a3e
- SHA512 04a7106f6524e255880ddfa58e9c3a7286374bb3e06057432be9b279c6cf2fc101c8796a39352fcb173eabc75b9d789af987cb34648f8d831ed5da2bfeba1345
- SSDEEP 98304:WIyatduIyatdtgPALJTIOSAz68QdLapIwI1H:eQdWQdMALJTfP8dcIzH
- TLSH T1ED967D2232D1452AF159AE3BCB267734A6A07C7A4FF1C28FF508729D19316F17A36316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-27_ded6037a08c67928b0336fda652bb2c7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_ded6037a08c67928b0336fda652bb2c7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260617-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-27_ded6037a08c67928b0336fda652bb2c7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar_wannacry
- Size 8.7MB
- SHA256 7e3b51f4305ff14042dea03bcc8ca8e70f447b58f30333ded54f7a21f187fabd
- MD5 ded6037a08c67928b0336fda652bb2c7
- SHA1 acef32ee844f2f344df20fc8cb3bf7c43cb65a3e
- SHA512 04a7106f6524e255880ddfa58e9c3a7286374bb3e06057432be9b279c6cf2fc101c8796a39352fcb173eabc75b9d789af987cb34648f8d831ed5da2bfeba1345
- SSDEEP 98304:WIyatduIyatdtgPALJTIOSAz68QdLapIwI1H:eQdWQdMALJTfP8dcIzH
- TLSH T1ED967D2232D1452AF159AE3BCB267734A6A07C7A4FF1C28FF508729D19316F17A36316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1