General
- Target 2026-07-06_b4c3664be66a6bae6e66df79f98269f3_amadey_cobalt-strike_glassworm_icedid_ryuk_satacom_vidar
- Size 2.2MB
- Sample260707-btyyesct3k
- SHA256 a7e356c16ba52472a645a2490898717794da7dee1d662d140e313d11e693c0b9
- MD5 b4c3664be66a6bae6e66df79f98269f3
- SHA1 c7235bad973af971c6f96dfda258720243519b3a
- SHA512 b5d30c676a7a09498c2ccb2f6998e98ae279439d357e25cce713cbfff93462b64be6f33e99a736816213047870e67922cad8d85dccb00665e242b2f1bc042661
- SSDEEP 12288:9jC6VOl7M+FSMBXZNYVLeyUji0h90ZD0wxpGZIVuKrHsmWwc1MWpk/c/TcS:gb7nIg0Le5ji0hmxNrM3zPP/9
- TLSH T1F7B59F126154A721CC5D5CB4B0C09277FDA02CDF3E1EB8876F44BEAE9937AD16BE1221
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_b4c3664be66a6bae6e66df79f98269f3_amadey_cobalt-strike_glassworm_icedid_ryuk_satacom_vidar.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_b4c3664be66a6bae6e66df79f98269f3_amadey_cobalt-strike_glassworm_icedid_ryuk_satacom_vidar.exe
Resource
win11ltsc2024-20260706-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-06_b4c3664be66a6bae6e66df79f98269f3_amadey_cobalt-strike_glassworm_icedid_ryuk_satacom_vidar
- Size 2.2MB
- SHA256 a7e356c16ba52472a645a2490898717794da7dee1d662d140e313d11e693c0b9
- MD5 b4c3664be66a6bae6e66df79f98269f3
- SHA1 c7235bad973af971c6f96dfda258720243519b3a
- SHA512 b5d30c676a7a09498c2ccb2f6998e98ae279439d357e25cce713cbfff93462b64be6f33e99a736816213047870e67922cad8d85dccb00665e242b2f1bc042661
- SSDEEP 12288:9jC6VOl7M+FSMBXZNYVLeyUji0h90ZD0wxpGZIVuKrHsmWwc1MWpk/c/TcS:gb7nIg0Le5ji0hmxNrM3zPP/9
- TLSH T1F7B59F126154A721CC5D5CB4B0C09277FDA02CDF3E1EB8876F44BEAE9937AD16BE1221
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.