General
- Target 2026-06-26_fd43968eaa0a9c5f9e8e88c1b994c6d4_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.0MB
- Sample260629-mwlxesa19z
- SHA256 e9b6561876600c0a823e1897c5d848f81e3945f25c1306435c6f3f7fe5a19c26
- MD5 fd43968eaa0a9c5f9e8e88c1b994c6d4
- SHA1 a945cba8beae10024edd9c8ba6ae74acfafb547e
- SHA512 55b741f4797c430660347b03b5031015fdb2db3153bfe9a31f40efcc1890caacf6317b5c1a9c5ad48c3db8645198178a36aeead2f59382f346ef09ffbe1425b8
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6YiLaaijim:A3kMPljt
- TLSH T1FE35BF23EBB090B5D22B49705AA59712EA397D210F6046CBE3E8972D1F313C17B3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-06-26_fd43968eaa0a9c5f9e8e88c1b994c6d4_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_fd43968eaa0a9c5f9e8e88c1b994c6d4_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260618-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-26_fd43968eaa0a9c5f9e8e88c1b994c6d4_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.0MB
- SHA256 e9b6561876600c0a823e1897c5d848f81e3945f25c1306435c6f3f7fe5a19c26
- MD5 fd43968eaa0a9c5f9e8e88c1b994c6d4
- SHA1 a945cba8beae10024edd9c8ba6ae74acfafb547e
- SHA512 55b741f4797c430660347b03b5031015fdb2db3153bfe9a31f40efcc1890caacf6317b5c1a9c5ad48c3db8645198178a36aeead2f59382f346ef09ffbe1425b8
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6YiLaaijim:A3kMPljt
- TLSH T1FE35BF23EBB090B5D22B49705AA59712EA397D210F6046CBE3E8972D1F313C17B3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory