General
- Target 2026-07-06_7cc2cd5ee560ba4afcc17fff4d39563a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry
- Size 6.1MB
- Sample260707-c84ynadv5n
- SHA256 73a284fd963e370826fe76a74da4d794524101b229b91834bb90c96a1169e5ab
- MD5 7cc2cd5ee560ba4afcc17fff4d39563a
- SHA1 e669c8e8bb8c74ba730743b4d6c9dcf0292093d0
- SHA512 23065bb3a18d41b8dec1a83290899d3bd8b5f5f44a5cf9578ea67649fae0361b15739f0a3f1600a63bffeaccd501788633440fa6f556001a06104eccb0ac019f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GWKYcL2y6i1zuajG:TID41qM5ram6m51KYcL2tBW1Pszx/c
- TLSH T153566B16B7A846A1E0778175C5A29296EE7278111F30C7CF1384E67D2F337D1EA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-06_7cc2cd5ee560ba4afcc17fff4d39563a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-06_7cc2cd5ee560ba4afcc17fff4d39563a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260706-en
Malware Config
Targets
-
- Target 2026-07-06_7cc2cd5ee560ba4afcc17fff4d39563a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry
- Size 6.1MB
- SHA256 73a284fd963e370826fe76a74da4d794524101b229b91834bb90c96a1169e5ab
- MD5 7cc2cd5ee560ba4afcc17fff4d39563a
- SHA1 e669c8e8bb8c74ba730743b4d6c9dcf0292093d0
- SHA512 23065bb3a18d41b8dec1a83290899d3bd8b5f5f44a5cf9578ea67649fae0361b15739f0a3f1600a63bffeaccd501788633440fa6f556001a06104eccb0ac019f
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatglnhOwY5fqatgljmpYqQY5GWKYcL2y6i1zuajG:TID41qM5ram6m51KYcL2tBW1Pszx/c
- TLSH T153566B16B7A846A1E0778175C5A29296EE7278111F30C7CF1384E67D2F337D1EA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1