General
- Target 2026-07-03_be2ba5334e47c029370a268bd1f65984_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_rhadamanthys_smoke-loader_stop_tofsee_vidar_wannacry
- Size 11.8MB
- Sample260703-pfngesdy4m
- SHA256 14d69cf32fc60dfc397027209726b9266934ade8099cbf30739bee8ffae1337e
- MD5 be2ba5334e47c029370a268bd1f65984
- SHA1 a1ad0d56a8b7511794d6eda74b69d7e956f04af2
- SHA512 eebec420a27d7a54280fc699e82ce3637247a1ed64cd072c2d463575a0abf914c210722ce6318fe6a73ec79d084263e647737e6b3bbb598aacf412746bb6206c
- SSDEEP 98304:kIOERqd/6hkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0E4jovLapINTIOSAIr:SEYd/6ZJEul4szEonqtaovcINTf8r
- TLSH T1DEC68D3275D58136D1664135CAA56FB4C3A57C3A4BF182CB76807AEE1E723C27932B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-03_be2ba5334e47c029370a268bd1f65984_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_be2ba5334e47c029370a268bd1f65984_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11ltsc2024-20260630-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-03_be2ba5334e47c029370a268bd1f65984_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_rhadamanthys_smoke-loader_stop_tofsee_vidar_wannacry
- Size 11.8MB
- SHA256 14d69cf32fc60dfc397027209726b9266934ade8099cbf30739bee8ffae1337e
- MD5 be2ba5334e47c029370a268bd1f65984
- SHA1 a1ad0d56a8b7511794d6eda74b69d7e956f04af2
- SHA512 eebec420a27d7a54280fc699e82ce3637247a1ed64cd072c2d463575a0abf914c210722ce6318fe6a73ec79d084263e647737e6b3bbb598aacf412746bb6206c
- SSDEEP 98304:kIOERqd/6hkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0E4jovLapINTIOSAIr:SEYd/6ZJEul4szEonqtaovcINTf8r
- TLSH T1DEC68D3275D58136D1664135CAA56FB4C3A57C3A4BF182CB76807AEE1E723C27932B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory