General
- Target 2026-07-01_b7610a79db7b23ad7583567afc7320f2_akira_amadey_cobalt-strike_elex_eternalromance_glassworm_hijackloader_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee_vidar_wannacry
- Size 9.6MB
- Sample260701-scaypsav7y
- SHA256 0b3416943fc5302db06c1086013a3c534c01062fdb8764f70f485fcf8b05c26d
- MD5 b7610a79db7b23ad7583567afc7320f2
- SHA1 444a9dc3b9dde7a4d7fb59867e98eefa8ee65406
- SHA512 20265866a695ba53e906794184b5472bd94440052216ad9f3d8956c911840e8f59cc6290e069d8f7bffa82d2cd80506cfb03924b6ed04aee4bcd3eac42c33578
- SSDEEP 98304:kIOu9jos/PvOAjcXvvOOc5pjoYH26Z5xF7x5Q9TIOSAGod0:Su5oKHOAoXvvOloa5aTfCod0
- TLSH T116A68D1EB3E84266E077D17DC4A28A19F771B4168B31C6CF2244975D2EB77D28E3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-01_b7610a79db7b23ad7583567afc7320f2_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_b7610a79db7b23ad7583567afc7320f2_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe
Resource
win11ltsc2024-20260629-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-01_b7610a79db7b23ad7583567afc7320f2_akira_amadey_cobalt-strike_elex_eternalromance_glassworm_hijackloader_icedid_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee_vidar_wannacry
- Size 9.6MB
- SHA256 0b3416943fc5302db06c1086013a3c534c01062fdb8764f70f485fcf8b05c26d
- MD5 b7610a79db7b23ad7583567afc7320f2
- SHA1 444a9dc3b9dde7a4d7fb59867e98eefa8ee65406
- SHA512 20265866a695ba53e906794184b5472bd94440052216ad9f3d8956c911840e8f59cc6290e069d8f7bffa82d2cd80506cfb03924b6ed04aee4bcd3eac42c33578
- SSDEEP 98304:kIOu9jos/PvOAjcXvvOOc5pjoYH26Z5xF7x5Q9TIOSAGod0:Su5oKHOAoXvvOloa5aTfCod0
- TLSH T116A68D1EB3E84266E077D17DC4A28A19F771B4168B31C6CF2244975D2EB77D28E3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory