General
- Target 2026-07-06_ab2dcc2c8bedaf998da214580115e56f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_maze_rhadamanthys_smoke-loader
- Size 1010KB
- Sample260707-b3t1tscv9q
- SHA256 3b3347fe774cd5369db8865660e24b7a408b13100197fd4f41e48e54d5f4c556
- MD5 ab2dcc2c8bedaf998da214580115e56f
- SHA1 2246b32755ca10687981edc1463c82a3315310f3
- SHA512 bd636c1db20c98ad56c70e9ed7855a77aa29be61529c20e7f543823be61556081e9d22ecd559f4a19790d0cf85fa286874849f23b43dde1f982b54c5a7eb4f4f
- SSDEEP 12288:uy+5+JL0dLo1d1W8vAwSfxL/2Dc3jDLLmt0LDQewsAjRcR420AmZXuY9:W5+t0pOdR4aewsAjmR0AhY9
- TLSH T17A253923BA60C471C16219310669971D9738F818CB530E87A2BC5EDDFFE06F16B39A76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_ab2dcc2c8bedaf998da214580115e56f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_ab2dcc2c8bedaf998da214580115e56f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260706-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-06_ab2dcc2c8bedaf998da214580115e56f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_maze_rhadamanthys_smoke-loader
- Size 1010KB
- SHA256 3b3347fe774cd5369db8865660e24b7a408b13100197fd4f41e48e54d5f4c556
- MD5 ab2dcc2c8bedaf998da214580115e56f
- SHA1 2246b32755ca10687981edc1463c82a3315310f3
- SHA512 bd636c1db20c98ad56c70e9ed7855a77aa29be61529c20e7f543823be61556081e9d22ecd559f4a19790d0cf85fa286874849f23b43dde1f982b54c5a7eb4f4f
- SSDEEP 12288:uy+5+JL0dLo1d1W8vAwSfxL/2Dc3jDLLmt0LDQewsAjRcR420AmZXuY9:W5+t0pOdR4aewsAjmR0AhY9
- TLSH T17A253923BA60C471C16219310669971D9738F818CB530E87A2BC5EDDFFE06F16B39A76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.