General
- Target 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_stealc_vidar_wannacry
- Size 10.3MB
- Sample260707-bmeafae16w
- SHA256 269159eecd27b8975a8c14b1ebe4576ee3d89d877ee8216482b6cf04852d78bc
- MD5 bd661402f54bbead4e9dabd460a1dbb1
- SHA1 2eea5501b28872eca9f0d12c5624594b5810f243
- SHA512 97ff4b7a3ebdf513c7ac7125b2fdcb74efe34290daafc573f077e5cd0afcd5aae7e90c98d82657395a2fd8a06168d50b34988ab351180888999e2a7f0d162b8a
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRL61joULapI969dG:8pAnjOyAdOrNTfgd7ozl6BoUcI969dG
- TLSH T158B67D12B2E00136D0B6917ACAA54725D7B13C7A4BF1C3DB7244B6D92E737C1BA36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260706-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-06_bd661402f54bbead4e9dabd460a1dbb1_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_stealc_vidar_wannacry
- Size 10.3MB
- SHA256 269159eecd27b8975a8c14b1ebe4576ee3d89d877ee8216482b6cf04852d78bc
- MD5 bd661402f54bbead4e9dabd460a1dbb1
- SHA1 2eea5501b28872eca9f0d12c5624594b5810f243
- SHA512 97ff4b7a3ebdf513c7ac7125b2fdcb74efe34290daafc573f077e5cd0afcd5aae7e90c98d82657395a2fd8a06168d50b34988ab351180888999e2a7f0d162b8a
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRL61joULapI969dG:8pAnjOyAdOrNTfgd7ozl6BoUcI969dG
- TLSH T158B67D12B2E00136D0B6917ACAA54725D7B13C7A4BF1C3DB7244B6D92E737C1BA36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Drops file in System32 directory