General
- Target 2026-07-05_b939f2f4c17e87d19ec6d0a73ca2eb9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.1MB
- Sample260705-tdg9vahs4n
- SHA256 ea6437f1da818acb377a4944c2ff44afc9b61e3869d87d27cd671de4a5139c26
- MD5 b939f2f4c17e87d19ec6d0a73ca2eb9e
- SHA1 51ca216b9c63cbe85fb75b5140bbd99962a045f1
- SHA512 42ed1864a469ae22d272be540add6405eb2d967c6d601162843c6daaad4e892f4210ed63c612cf3a7bbd9d09bcf3c8d85742769f70b75e006bb1470f3ff75b34
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaitg04Xsf3z:A3mnXoZjzyaT4aewsAjxTc6rbaitgiD
- TLSH T110357C12EA6090A5D12E4570DBA58712B63B7C210BE096CBA3E8D63D1F317C06FFA757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-05_b939f2f4c17e87d19ec6d0a73ca2eb9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_b939f2f4c17e87d19ec6d0a73ca2eb9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260629-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-05_b939f2f4c17e87d19ec6d0a73ca2eb9e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.1MB
- SHA256 ea6437f1da818acb377a4944c2ff44afc9b61e3869d87d27cd671de4a5139c26
- MD5 b939f2f4c17e87d19ec6d0a73ca2eb9e
- SHA1 51ca216b9c63cbe85fb75b5140bbd99962a045f1
- SHA512 42ed1864a469ae22d272be540add6405eb2d967c6d601162843c6daaad4e892f4210ed63c612cf3a7bbd9d09bcf3c8d85742769f70b75e006bb1470f3ff75b34
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsAjRXTc6rbaitg04Xsf3z:A3mnXoZjzyaT4aewsAjxTc6rbaitgiD
- TLSH T110357C12EA6090A5D12E4570DBA58712B63B7C210BE096CBA3E8D63D1F317C06FFA757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory