General
- Target 2026-07-07_961d896264ec37ef09bad0da6f611730_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar_wannacry
- Size 6.3MB
- Sample260707-janmcacv6y
- SHA256 48d53689ddb370984fca5e1f4c29d1695ef655c4ee25e3865d7ec7d578df3050
- MD5 961d896264ec37ef09bad0da6f611730
- SHA1 68931f37622413b49169c35ab8124b68282686ac
- SHA512 ac6d9a4e1117fab53f1ebf7c25d40154f169161f50c7f609d007e35d76a28cbcb4876dc33cf8fdaf1ffc7f1c550bb873929b2480c762f12c0b2cda308b801301
- SSDEEP 196608:njBxcO4VjmooM95s3CRm0rLh5LVMbB50Hq:XIoM95s3MVrLh5LVMbB50K
- TLSH T195666C12BB52C1B3C86A8234C49A96F6E77CBC44C72087873A54BE557F733D21D2AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-07_961d896264ec37ef09bad0da6f611730_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-07_961d896264ec37ef09bad0da6f611730_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260706-en
Malware Config
Targets
-
- Target 2026-07-07_961d896264ec37ef09bad0da6f611730_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar_wannacry
- Size 6.3MB
- SHA256 48d53689ddb370984fca5e1f4c29d1695ef655c4ee25e3865d7ec7d578df3050
- MD5 961d896264ec37ef09bad0da6f611730
- SHA1 68931f37622413b49169c35ab8124b68282686ac
- SHA512 ac6d9a4e1117fab53f1ebf7c25d40154f169161f50c7f609d007e35d76a28cbcb4876dc33cf8fdaf1ffc7f1c550bb873929b2480c762f12c0b2cda308b801301
- SSDEEP 196608:njBxcO4VjmooM95s3CRm0rLh5LVMbB50Hq:XIoM95s3MVrLh5LVMbB50K
- TLSH T195666C12BB52C1B3C86A8234C49A96F6E77CBC44C72087873A54BE557F733D21D2AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1