cc11ba3a4c5fdfbeae62c7547334b064b244c5ee834087b3ab8b71a676647723

General

Target
2026-07-06_dd1e43c4bde0bd9e5dd5c6701eab400c_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
Size 1.9MB
Sample260707-avjdpaev5v
SHA256 cc11ba3a4c5fdfbeae62c7547334b064b244c5ee834087b3ab8b71a676647723
MD5 dd1e43c4bde0bd9e5dd5c6701eab400c
SHA1 20f0cfb4c1478db4bebc69bfb2fea01c86979d91
SHA512 b9b253c8f367f43c2d5b8a50aaada1c0ed67544ed81a1784f70326780540ff5d714b3a1725efde5f2becb2ef3a7214acbb398502daeabbea03e6c36a325c2cb3
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6rbaRa45jcAkSYqyEPB0Le5ji0hmxNrM:A3kMPlj2pYq5Pji0Aj
TLSH
T18E954A16F6B48275D073C0B5C9D2975AEA313C810B308ADB5399E7682F377D29A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-06_dd1e43c4bde0bd9e5dd5c6701eab400c_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.9MB
- SHA256 cc11ba3a4c5fdfbeae62c7547334b064b244c5ee834087b3ab8b71a676647723
- MD5 dd1e43c4bde0bd9e5dd5c6701eab400c
- SHA1 20f0cfb4c1478db4bebc69bfb2fea01c86979d91
- SHA512 b9b253c8f367f43c2d5b8a50aaada1c0ed67544ed81a1784f70326780540ff5d714b3a1725efde5f2becb2ef3a7214acbb398502daeabbea03e6c36a325c2cb3
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6rbaRa45jcAkSYqyEPB0Le5ji0hmxNrM:A3kMPlj2pYq5Pji0Aj
- TLSH
  T18E954A16F6B48275D073C0B5C9D2975AEA313C810B308ADB5399E7682F377D29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

aspackv2 discovery persistence spyware stealer adware
- Detects executables packed with ASPack
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2