General
- Target 2026-06-29_6fd499bc1df6b46c75ec85f3040b831c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar_wannacry
- Size 11.7MB
- Sample260630-j39ehsaw6s
- SHA256 ad2c0151e2f9f688fa324875685f9ac89f6ab138ad6e752883f64169fc7ab9d1
- MD5 6fd499bc1df6b46c75ec85f3040b831c
- SHA1 828bd37255eb3994e288183abcc4b48ed28cd38e
- SHA512 283746d19040e86b15d0c76e9894d13af2c3a85211f5f9c611557028f704624066b01ba0c948f2936daad8092aa5d66479899ea32457c475ca1ee38cfa0e3632
- SSDEEP 98304:fIyatduIyatdtgPALJTILIyatduIyatdtgPALJTI+:pQdWQdMALJTmQdWQdMALJTF
- TLSH T184C67D233290453BF129AE3BC22A7738B9207D7A4EA2C54FF90C761D59752F25A77312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-29_6fd499bc1df6b46c75ec85f3040b831c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-29_6fd499bc1df6b46c75ec85f3040b831c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win11ltsc2024-20260629-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-29_6fd499bc1df6b46c75ec85f3040b831c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar_wannacry
- Size 11.7MB
- SHA256 ad2c0151e2f9f688fa324875685f9ac89f6ab138ad6e752883f64169fc7ab9d1
- MD5 6fd499bc1df6b46c75ec85f3040b831c
- SHA1 828bd37255eb3994e288183abcc4b48ed28cd38e
- SHA512 283746d19040e86b15d0c76e9894d13af2c3a85211f5f9c611557028f704624066b01ba0c948f2936daad8092aa5d66479899ea32457c475ca1ee38cfa0e3632
- SSDEEP 98304:fIyatduIyatdtgPALJTILIyatduIyatdtgPALJTI+:pQdWQdMALJTmQdWQdMALJTF
- TLSH T184C67D233290453BF129AE3BC22A7738B9207D7A4EA2C54FF90C761D59752F25A77312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Executes dropped EXE
-
Drops file in System32 directory