General
- Target 2026-07-06_e7e1995baa4b5c2ef218f57af123ad64_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_remcos_rhadamanthys_stealc_vidar_wannacry
- Size 15.0MB
- Sample260707-aksjlses6y
- SHA256 e26b6d32b780955bcbb0518223b5e25c7f738813570d40e9ed9635912c5ca198
- MD5 e7e1995baa4b5c2ef218f57af123ad64
- SHA1 0d8844ce1c98593370dffc623456b25687755980
- SHA512 5d421c3e15bfa4f0b6640421c6f7cb0da5ffdb1e82d0a67ffb363de9fb7e56f6d73923c2eed198952f6d6cd1d44de0fb5f2c06117c5ce4fe988260be4758df42
- SSDEEP 196608:8pAnjOyAdOrNTfgd7ozl6BoUcI+gTH2qBpu1QfLIqsuf2:OAntRQ+h6THNBpu1Qfc02
- TLSH T120F66B1272D54FA9C06F9034CE16266196633C6A8FB1DBDF2540BE693E327E06E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-06_e7e1995baa4b5c2ef218f57af123ad64_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_e7e1995baa4b5c2ef218f57af123ad64_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win11ltsc2024-20260706-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-06_e7e1995baa4b5c2ef218f57af123ad64_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_remcos_rhadamanthys_stealc_vidar_wannacry
- Size 15.0MB
- SHA256 e26b6d32b780955bcbb0518223b5e25c7f738813570d40e9ed9635912c5ca198
- MD5 e7e1995baa4b5c2ef218f57af123ad64
- SHA1 0d8844ce1c98593370dffc623456b25687755980
- SHA512 5d421c3e15bfa4f0b6640421c6f7cb0da5ffdb1e82d0a67ffb363de9fb7e56f6d73923c2eed198952f6d6cd1d44de0fb5f2c06117c5ce4fe988260be4758df42
- SSDEEP 196608:8pAnjOyAdOrNTfgd7ozl6BoUcI+gTH2qBpu1QfLIqsuf2:OAntRQ+h6THNBpu1Qfc02
- TLSH T120F66B1272D54FA9C06F9034CE16266196633C6A8FB1DBDF2540BE693E327E06E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Drops file in System32 directory