General
- Target 2026-07-10_55b5495d9b599d19befc7d5c3366cc5a_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar
- Size 1.5MB
- Sample260710-trdhtae17s
- SHA256 7198b79434d21cb3efeb96b85ada2be52e4ff29aecffc9e41543b2955f7f5c94
- MD5 55b5495d9b599d19befc7d5c3366cc5a
- SHA1 0c52dd4d182d0e59626e1f6246d0168d604a380b
- SHA512 a2fd755a8fc9168325718abe3a0112bcad5dd521556e88b26e1a98f1272e9e921a09ffa8c515054655c014880af2d572a4443dead43ca80ef37f97d30d2fdffd
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTcgGLYCD5TvinrmVD5TvinrmVD5TvinrmC:A3kMPljE56ru56ru56rX
- TLSH T1D9757D12B6A88FA5C12F81748A918666E7777C114F2047CF53A4BE293F327D06E3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-10_55b5495d9b599d19befc7d5c3366cc5a_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_55b5495d9b599d19befc7d5c3366cc5a_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-10_55b5495d9b599d19befc7d5c3366cc5a_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar
- Size 1.5MB
- SHA256 7198b79434d21cb3efeb96b85ada2be52e4ff29aecffc9e41543b2955f7f5c94
- MD5 55b5495d9b599d19befc7d5c3366cc5a
- SHA1 0c52dd4d182d0e59626e1f6246d0168d604a380b
- SHA512 a2fd755a8fc9168325718abe3a0112bcad5dd521556e88b26e1a98f1272e9e921a09ffa8c515054655c014880af2d572a4443dead43ca80ef37f97d30d2fdffd
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTcgGLYCD5TvinrmVD5TvinrmVD5TvinrmC:A3kMPljE56ru56ru56rX
- TLSH T1D9757D12B6A88FA5C12F81748A918666E7777C114F2047CF53A4BE293F327D06E3A753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory