General
- Target 2026-07-10_8a9e150d648416b3eb162b856d5d2128_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar
- Size 1.3MB
- Sample260710-fxfngaex6z
- SHA256 a506573e51ef0a73b333fe404dc7ba274740e49a33577f840195f189e9b7cb29
- MD5 8a9e150d648416b3eb162b856d5d2128
- SHA1 22aa1a0f5c0a42a76a323c3b5a1019f1429a51b6
- SHA512 6895fd7bf743ac3cc50c3c8c172fdfaa11c2b0d4c034d6eb9b32117980ba11b3b2b63bc55f1edf03accaec5a279d641fad7f41af95e8cf1a1818b0e2f9d88e01
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6r2JoI5D5TvinrmVD5TvinrmC:A3kMPljk56ru56rX
- TLSH T107559D12B6A48FA5C12F81749AA18662E7777C114F2047CF53A4AE293F327C06F3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-10_8a9e150d648416b3eb162b856d5d2128_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_8a9e150d648416b3eb162b856d5d2128_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-10_8a9e150d648416b3eb162b856d5d2128_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar
- Size 1.3MB
- SHA256 a506573e51ef0a73b333fe404dc7ba274740e49a33577f840195f189e9b7cb29
- MD5 8a9e150d648416b3eb162b856d5d2128
- SHA1 22aa1a0f5c0a42a76a323c3b5a1019f1429a51b6
- SHA512 6895fd7bf743ac3cc50c3c8c172fdfaa11c2b0d4c034d6eb9b32117980ba11b3b2b63bc55f1edf03accaec5a279d641fad7f41af95e8cf1a1818b0e2f9d88e01
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6r2JoI5D5TvinrmVD5TvinrmC:A3kMPljk56ru56rX
- TLSH T107559D12B6A48FA5C12F81749AA18662E7777C114F2047CF53A4AE293F327C06F3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory