General
- Target 2026-07-07_41ed2ebab9dcbf8b1c82e0db01030e81_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar
- Size 2.5MB
- Sample260707-zmsptset5y
- SHA256 51b0c63acd37cb573738d287f989f3da525889faf403059eca0800b3905e5d1a
- MD5 41ed2ebab9dcbf8b1c82e0db01030e81
- SHA1 a103a10e679845b792037b06e738d5d0fb174032
- SHA512 3e6d3086ba5b3ca6052d7fa68d4a3d81f20205f9010a651745486425f7db59096bd0d08bfe323e28659578c496aabc742c2f683fab919859f9b9512281b2fe16
- SSDEEP 24576:P0qSd0YA6egadV0MKCsgGFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT0f:sj/usgGJkGYYpT0+TFiH7efPH2
- TLSH T16CC5BE01F3D666B6C47F0578847A96166775BC0503A6DBFB93D0A9BA2C333C04E327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-07_41ed2ebab9dcbf8b1c82e0db01030e81_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_41ed2ebab9dcbf8b1c82e0db01030e81_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar.exe
Resource
win11ltsc2024-20260706-en
18 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-07_41ed2ebab9dcbf8b1c82e0db01030e81_amadey_elex_glassworm_hellokitty_icedid_remcos_vidar
- Size 2.5MB
- SHA256 51b0c63acd37cb573738d287f989f3da525889faf403059eca0800b3905e5d1a
- MD5 41ed2ebab9dcbf8b1c82e0db01030e81
- SHA1 a103a10e679845b792037b06e738d5d0fb174032
- SHA512 3e6d3086ba5b3ca6052d7fa68d4a3d81f20205f9010a651745486425f7db59096bd0d08bfe323e28659578c496aabc742c2f683fab919859f9b9512281b2fe16
- SSDEEP 24576:P0qSd0YA6egadV0MKCsgGFj+Ifz3zvnXj/zXzvAAkGz8mvgtX79S+2bfh+RfmT0f:sj/usgGJkGYYpT0+TFiH7efPH2
- TLSH T16CC5BE01F3D666B6C47F0578847A96166775BC0503A6DBFB93D0A9BA2C333C04E327A6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.