General
- Target 2026-06-27_ac134c2e24e1aa0095363bfe568f1093_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar
- Size 1.7MB
- Sample260629-eltkhsdy8m
- SHA256 3c64c1a4a10b4c9a5aa63223f5525c42112aff09918ef5aa6900da2f4ff3edc2
- MD5 ac134c2e24e1aa0095363bfe568f1093
- SHA1 32eab9a252bd0a8f09a17b7139f7d61b7ac97b20
- SHA512 7197a38d42c053b1f094a2b9932ddcc8ae57c71c45d15bb4f4ce9c406152d8aab95452eb1f73b8081f19d67d73306f08af99cc46ce99520ce62eedc4b177605e
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yi5J5D5TvinrmgB0Le5ji0hmxNrM:A3kMPljV56rJPji0Aj
- TLSH T147855B12F6A48B75D17B8074C9929656EA333C410F308BDB5394BF693E337D19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-06-27_ac134c2e24e1aa0095363bfe568f1093_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_ac134c2e24e1aa0095363bfe568f1093_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260618-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-27_ac134c2e24e1aa0095363bfe568f1093_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar
- Size 1.7MB
- SHA256 3c64c1a4a10b4c9a5aa63223f5525c42112aff09918ef5aa6900da2f4ff3edc2
- MD5 ac134c2e24e1aa0095363bfe568f1093
- SHA1 32eab9a252bd0a8f09a17b7139f7d61b7ac97b20
- SHA512 7197a38d42c053b1f094a2b9932ddcc8ae57c71c45d15bb4f4ce9c406152d8aab95452eb1f73b8081f19d67d73306f08af99cc46ce99520ce62eedc4b177605e
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yi5J5D5TvinrmgB0Le5ji0hmxNrM:A3kMPljV56rJPji0Aj
- TLSH T147855B12F6A48B75D17B8074C9929656EA333C410F308BDB5394BF693E337D19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory