General
- Target 2026-06-27_68a4c927745a8af67999afb89cf7598e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
- Size 2.0MB
- Sample260629-han3fae19t
- SHA256 2d0213a6ebee59cefe324ec3f626a0d011f926a82daa1b41af6fc85333d986bd
- MD5 68a4c927745a8af67999afb89cf7598e
- SHA1 c7e0957a2050c11dad4ac065171d7bae78611058
- SHA512 7a814fa5f99086bf9dc49aa4dc05600e23259e5589b752a19bd0c593a19b18bb668ae3c14f0a83a8b788f15d31b998d90e6d3186fdd961cc2f6bc82f6190ad2c
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TKFEz3N+tCn50ChWdArKW45jcAkSYqyE:A3kM8ljU8tDZqrKvpYq
- TLSH T1BCA57B12FBB482B1D0778175C6A2D676FA7178410B309BCB9394C76D2F236E19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-06-27_68a4c927745a8af67999afb89cf7598e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_68a4c927745a8af67999afb89cf7598e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260618-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-27_68a4c927745a8af67999afb89cf7598e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
- Size 2.0MB
- SHA256 2d0213a6ebee59cefe324ec3f626a0d011f926a82daa1b41af6fc85333d986bd
- MD5 68a4c927745a8af67999afb89cf7598e
- SHA1 c7e0957a2050c11dad4ac065171d7bae78611058
- SHA512 7a814fa5f99086bf9dc49aa4dc05600e23259e5589b752a19bd0c593a19b18bb668ae3c14f0a83a8b788f15d31b998d90e6d3186fdd961cc2f6bc82f6190ad2c
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TKFEz3N+tCn50ChWdArKW45jcAkSYqyE:A3kM8ljU8tDZqrKvpYq
- TLSH T1BCA57B12FBB482B1D0778175C6A2D676FA7178410B309BCB9394C76D2F236E19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory