General
- Target 2026-07-08_d1beda87e82d29106912acb59de887dd_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_quasar-rat_stealc_vidar
- Size 15.5MB
- Sample260708-cnbrdaas4q
- SHA256 57e3128fa53f6e1623cddde4f73203bf02827a241304dfcf8a00b09e8e654edc
- MD5 d1beda87e82d29106912acb59de887dd
- SHA1 e937847a827fce515070e5e974f5e39f66e44447
- SHA512 02fb14982f6e0e049d50640c34219550664a53b8f25065b0ccfb767eb36d66f400b5d0da83d809d7621538411e089b5f02eca786676aeff2480c7a4db9b66bd1
- SSDEEP 196608:WNAe7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouo:5eahvQHrc8u3xXJ/f4uUWHT
- TLSH T177F69D17B35681E6C02AE2B88A474323E7B5BC440330A7DB16D5BB692F77BE4573A350
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-08_d1beda87e82d29106912acb59de887dd_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-08_d1beda87e82d29106912acb59de887dd_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260706-en
Malware Config
Targets
-
- Target 2026-07-08_d1beda87e82d29106912acb59de887dd_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_quasar-rat_stealc_vidar
- Size 15.5MB
- SHA256 57e3128fa53f6e1623cddde4f73203bf02827a241304dfcf8a00b09e8e654edc
- MD5 d1beda87e82d29106912acb59de887dd
- SHA1 e937847a827fce515070e5e974f5e39f66e44447
- SHA512 02fb14982f6e0e049d50640c34219550664a53b8f25065b0ccfb767eb36d66f400b5d0da83d809d7621538411e089b5f02eca786676aeff2480c7a4db9b66bd1
- SSDEEP 196608:WNAe7APhNNECwHrc8u3x3AEcq/fByuKlWH3CTouo:5eahvQHrc8u3xXJ/f4uUWHT
- TLSH T177F69D17B35681E6C02AE2B88A474323E7B5BC440330A7DB16D5BB692F77BE4573A350
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables packed with Dotfuscator
-
Detects executables packed with SmartAssembly
-
Detects executables packed with Yano Obfuscator
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1