General
- Target 2026-07-08_bad76dd9dc202660d93e5604220f63b5_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry
- Size 3.2MB
- Sample260708-ys2n9af14l
- SHA256 2ad6419e56c4f068f4150354150f595e729cff47f15f15b24b622edee02ac50c
- MD5 bad76dd9dc202660d93e5604220f63b5
- SHA1 06c463b7893eb214b43043cae5ff329922dbfd5b
- SHA512 3ba84bd4d386d9c939914a5ff6d81eccdfff2ec3d98700359772adf85c60edc80c0a525960e20b840f721be3beac9c8e2962556cd2cc58edd3f95413a9cc434c
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9MFXpEpYq:TID41vyW1PsznG6
- TLSH T1CCF59E02F7D485B2E0B3513189A752A6AA7278211F31C7CF1394A27D6F33BC1AE35766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_bad76dd9dc202660d93e5604220f63b5_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_bad76dd9dc202660d93e5604220f63b5_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-08_bad76dd9dc202660d93e5604220f63b5_amadey_elex_glassworm_icedid_njrat_remcos_vidar_wannacry
- Size 3.2MB
- SHA256 2ad6419e56c4f068f4150354150f595e729cff47f15f15b24b622edee02ac50c
- MD5 bad76dd9dc202660d93e5604220f63b5
- SHA1 06c463b7893eb214b43043cae5ff329922dbfd5b
- SHA512 3ba84bd4d386d9c939914a5ff6d81eccdfff2ec3d98700359772adf85c60edc80c0a525960e20b840f721be3beac9c8e2962556cd2cc58edd3f95413a9cc434c
- SSDEEP 49152:W/4MnYYJ2ZhqSGLHyqatglYqatgluDWW1PszNsehO9MFXpEpYq:TID41vyW1PsznG6
- TLSH T1CCF59E02F7D485B2E0B3513189A752A6AA7278211F31C7CF1394A27D6F33BC1AE35766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory