General
- Target 2026-06-30_ed7d05e8476d46144bf3b474526565f2_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar_wannacry
- Size 5.7MB
- Sample260701-cm2amscv9j
- SHA256 c5a3f1caad90bc3651509c62b293cdb502ce2a5f3379d8c2535c0bfff9a6c61c
- MD5 ed7d05e8476d46144bf3b474526565f2
- SHA1 a32667a894f17e6a275877776164e09240a7a220
- SHA512 358cdd3b02d97d606e5eaa9e77f19bb5c046c3bf0bb18ec23f60c30e57858ff4f461a7e512a0191364a84760865e4f3d3be01cec7e573b945ba686669392438c
- SSDEEP 49152:PabH/N1IyNabH/HJVBXdcWabH/3IyNabH/HJVBXdcT4qiw3PASW9mMtJT3S9tsg2:8IyatduIyatdtgPALJTIS
- TLSH T105567D233290452BF129AE3BC22A7738B9207D7A5EA2C54FF90C761D19752F25B77306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-30_ed7d05e8476d46144bf3b474526565f2_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_ed7d05e8476d46144bf3b474526565f2_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win11ltsc2024-20260629-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-30_ed7d05e8476d46144bf3b474526565f2_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar_wannacry
- Size 5.7MB
- SHA256 c5a3f1caad90bc3651509c62b293cdb502ce2a5f3379d8c2535c0bfff9a6c61c
- MD5 ed7d05e8476d46144bf3b474526565f2
- SHA1 a32667a894f17e6a275877776164e09240a7a220
- SHA512 358cdd3b02d97d606e5eaa9e77f19bb5c046c3bf0bb18ec23f60c30e57858ff4f461a7e512a0191364a84760865e4f3d3be01cec7e573b945ba686669392438c
- SSDEEP 49152:PabH/N1IyNabH/HJVBXdcWabH/3IyNabH/HJVBXdcT4qiw3PASW9mMtJT3S9tsg2:8IyatduIyatdtgPALJTIS
- TLSH T105567D233290452BF129AE3BC22A7738B9207D7A5EA2C54FF90C761D19752F25B77306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Executes dropped EXE
-
Drops file in System32 directory