a802e3306fa4d990500927225c79fc9880bad958867581c98c36654b0caab3aa

General

Target
2026-07-02_bc42b2635041d7cedd2872dc58ac5a03_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_icedid_rhadamanthys_stop_vidar
Size 6.7MB
Sample260703-bhyhhset4p
SHA256 a802e3306fa4d990500927225c79fc9880bad958867581c98c36654b0caab3aa
MD5 bc42b2635041d7cedd2872dc58ac5a03
SHA1 2cb1ee8c1f40604b0beb3f8707bc5b5e6268ab67
SHA512 f0fb94d8d8ae77105d3bcdc9b19168366a841df753adda645ae303711abda03feed449af1024dfa59fc29e33e0a3194a1f49f4eab1e74c027d03997984ebfc47
SSDEEP 49152:/DHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJkY56Xpr56rSXp8eW4Y:wpGfQJdXN0B7+sitx5FrpfkZc34tjo
TLSH
T188666B2AB2B84671E077D079C593964AEA727C110B3187CF1294AB2D3F377D1D93A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-02_bc42b2635041d7cedd2872dc58ac5a03_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_icedid_rhadamanthys_stop_vidar
- Size 6.7MB
- SHA256 a802e3306fa4d990500927225c79fc9880bad958867581c98c36654b0caab3aa
- MD5 bc42b2635041d7cedd2872dc58ac5a03
- SHA1 2cb1ee8c1f40604b0beb3f8707bc5b5e6268ab67
- SHA512 f0fb94d8d8ae77105d3bcdc9b19168366a841df753adda645ae303711abda03feed449af1024dfa59fc29e33e0a3194a1f49f4eab1e74c027d03997984ebfc47
- SSDEEP 49152:/DHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJkY56Xpr56rSXp8eW4Y:wpGfQJdXN0B7+sitx5FrpfkZc34tjo
- TLSH
  T188666B2AB2B84671E077D079C593964AEA727C110B3187CF1294AB2D3F377D1D93A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery installer persistence spyware stealer adware ransomware
- Detects executables packed with ASPack
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2