General
- Target 2026-07-06_c423bfc5a06b71fa0a88c35ac727237f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee_vidar_wannacry
- Size 17.9MB
- Sample260707-bft3babz5k
- SHA256 0c96a1b00d269b9c06461f7f42cac84f608afdd6b48759c6cc70e27aae01453e
- MD5 c423bfc5a06b71fa0a88c35ac727237f
- SHA1 ece6d6cac1bd356263e6e79029f0cfe2d557000c
- SHA512 e8dbbc7754f3f62a03324bff4160d6a61033556391c15708bc058c948f5337ea876ed61754a2eda674179f95883e5127c54a51fb7bf98d3840fd32cce1266708
- SSDEEP 196608:Su5oaHOAoXvvO/qzBUdEcIYeGZF6bUpMBF1p/kjRm4OWi2b0TfyoF:6wOTKqzBQZIbUwF1VERmj2bA9F
- TLSH T12617CF1A7294006DD16BD07DCB528926D7B07C5A8BB196DF2240B7A92FB37E13F3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-06_c423bfc5a06b71fa0a88c35ac727237f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_c423bfc5a06b71fa0a88c35ac727237f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe
Resource
win11ltsc2024-20260706-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-06_c423bfc5a06b71fa0a88c35ac727237f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee_vidar_wannacry
- Size 17.9MB
- SHA256 0c96a1b00d269b9c06461f7f42cac84f608afdd6b48759c6cc70e27aae01453e
- MD5 c423bfc5a06b71fa0a88c35ac727237f
- SHA1 ece6d6cac1bd356263e6e79029f0cfe2d557000c
- SHA512 e8dbbc7754f3f62a03324bff4160d6a61033556391c15708bc058c948f5337ea876ed61754a2eda674179f95883e5127c54a51fb7bf98d3840fd32cce1266708
- SSDEEP 196608:Su5oaHOAoXvvO/qzBUdEcIYeGZF6bUpMBF1p/kjRm4OWi2b0TfyoF:6wOTKqzBQZIbUwF1VERmj2bA9F
- TLSH T12617CF1A7294006DD16BD07DCB528926D7B07C5A8BB196DF2240B7A92FB37E13F3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory