General
- Target 2026-07-02_c1c7ecdc35c9c9a0207944875415c1a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar_wannacry
- Size 13.9MB
- Sample260702-m34e2sgv9v
- SHA256 aa72ee3feab21cedb8657699958fe4017f624e1b1dcce813baef4e34106b0d0d
- MD5 c1c7ecdc35c9c9a0207944875415c1a3
- SHA1 3d897737faddbd0a6d3ced9280cded402787aae1
- SHA512 d7e421a0629bae0ac7fcf66029d442eb54ebb914ac8fa6b097769944f57528d793d5282d75ffac77b888aae482c40b1e91e95f096a5fc4a94d387366e84a6453
- SSDEEP 98304:WIyatduIyatdtgPALJTIOSAz68QyIyatduIyatdtgPALJTIOSAz68Q:eQdWQdMALJTfP8iQdWQdMALJTfP8
- TLSH T14AE67E223290452BF129AE3BC22A7738B9307D6A5FB1C68FE50C761D19357F24E76352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-02_c1c7ecdc35c9c9a0207944875415c1a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_c1c7ecdc35c9c9a0207944875415c1a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260630-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_c1c7ecdc35c9c9a0207944875415c1a3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar_wannacry
- Size 13.9MB
- SHA256 aa72ee3feab21cedb8657699958fe4017f624e1b1dcce813baef4e34106b0d0d
- MD5 c1c7ecdc35c9c9a0207944875415c1a3
- SHA1 3d897737faddbd0a6d3ced9280cded402787aae1
- SHA512 d7e421a0629bae0ac7fcf66029d442eb54ebb914ac8fa6b097769944f57528d793d5282d75ffac77b888aae482c40b1e91e95f096a5fc4a94d387366e84a6453
- SSDEEP 98304:WIyatduIyatdtgPALJTIOSAz68QyIyatduIyatdtgPALJTIOSAz68Q:eQdWQdMALJTfP8iQdWQdMALJTfP8
- TLSH T14AE67E223290452BF129AE3BC22A7738B9307D6A5FB1C68FE50C761D19357F24E76352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Executes dropped EXE
-
Drops file in System32 directory