General
- Target 2026-07-10_f32e0a8efa3f8f92d7864c6d8740a9ef_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.3MB
- Sample260710-fn3rmsew2z
- SHA256 1063b5ee507faaf4f3296a9343b53facc2a09cea2b446bb04bb21ddd05869c8b
- MD5 f32e0a8efa3f8f92d7864c6d8740a9ef
- SHA1 fa592cf06805d14c34492424e636fc2426f0073f
- SHA512 0a0a70c94f4a614d3796565b3df988db9c42fe75e4e6ae19c76f33bd523be5990c588ed5aa8fe5d1a4a68177662d8850266a48f401fff29a08e8f2359b9b6287
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6rbaCS19D5TvinrmVD5TvinrmC:A3kMPlja56ru56rX
- TLSH T1A7559D12B6A48FA5D12F81749AA18622E7777C114F2047CF53A4AE293F327C06F3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-10_f32e0a8efa3f8f92d7864c6d8740a9ef_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_f32e0a8efa3f8f92d7864c6d8740a9ef_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-10_f32e0a8efa3f8f92d7864c6d8740a9ef_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.3MB
- SHA256 1063b5ee507faaf4f3296a9343b53facc2a09cea2b446bb04bb21ddd05869c8b
- MD5 f32e0a8efa3f8f92d7864c6d8740a9ef
- SHA1 fa592cf06805d14c34492424e636fc2426f0073f
- SHA512 0a0a70c94f4a614d3796565b3df988db9c42fe75e4e6ae19c76f33bd523be5990c588ed5aa8fe5d1a4a68177662d8850266a48f401fff29a08e8f2359b9b6287
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6rbaCS19D5TvinrmVD5TvinrmC:A3kMPlja56ru56rX
- TLSH T1A7559D12B6A48FA5D12F81749AA18622E7777C114F2047CF53A4AE293F327C06F3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory