General
- Target 2026-07-02_fe31bdaf878b50ed3ad5c62105ada158_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar
- Size 4.9MB
- Sample260702-tfx33shs8z
- SHA256 59c130b7d6d646c9c42ec11dc3d1295743f2b7e2191a197ccb21551ed01dd216
- MD5 fe31bdaf878b50ed3ad5c62105ada158
- SHA1 d45df9a2577f586ef70b007bf1307b6deaa1877d
- SHA512 2bb3212ae7af1d02ce657f0fd266377ece79b1b944efcf4e97d951304a87423598f954b960f466e3dcca9c019db6d8010bd14dc2c1104fcfbdcf7dcd4abde439
- SSDEEP 49152:TDHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJkY5C/qJtb2IVXpr56v:0pGfQJdXN0B7+sitx5C/3r7fkZc
- TLSH T12C367C2AB2B88772E077C179C5D69655F97278211F3087CF1284973C2F376D2993AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-02_fe31bdaf878b50ed3ad5c62105ada158_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_fe31bdaf878b50ed3ad5c62105ada158_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar
- Size 4.9MB
- SHA256 59c130b7d6d646c9c42ec11dc3d1295743f2b7e2191a197ccb21551ed01dd216
- MD5 fe31bdaf878b50ed3ad5c62105ada158
- SHA1 d45df9a2577f586ef70b007bf1307b6deaa1877d
- SHA512 2bb3212ae7af1d02ce657f0fd266377ece79b1b944efcf4e97d951304a87423598f954b960f466e3dcca9c019db6d8010bd14dc2c1104fcfbdcf7dcd4abde439
- SSDEEP 49152:TDHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJkY5C/qJtb2IVXpr56v:0pGfQJdXN0B7+sitx5C/3r7fkZc
- TLSH T12C367C2AB2B88772E077C179C5D69655F97278211F3087CF1284973C2F376D2993AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory