General
- Target 2026-07-10_9bae518bc7173decb959a83a2f1d7d23_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
- Size 2.7MB
- Sample260710-v5fe1adw5q
- SHA256 e8ae8fad68d0eb38dc80e7233764a664b7226f0c26c464efa136dd78a9fa7b9c
- MD5 9bae518bc7173decb959a83a2f1d7d23
- SHA1 d663961330a6ec257a3293d88fea42436833c81d
- SHA512 591d083fc6e7b71f8b97be831de89839bb79f8faa3b16f66ba80cb1afb203571459edaf76b76135f139297b088424fd76d3f516a3d18ab0366d6e0fc54cfc347
- SSDEEP 49152:A3kM8ljouygmUSbHDUnxeW4SkZP4sz9Mbj:A3kM7UEwfkZcj
- TLSH T199D55B55F7B882B2E0B38175C9A69666FA727C420B308ACF0254E32D1E377D19E35736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-10_9bae518bc7173decb959a83a2f1d7d23_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_9bae518bc7173decb959a83a2f1d7d23_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-10_9bae518bc7173decb959a83a2f1d7d23_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
- Size 2.7MB
- SHA256 e8ae8fad68d0eb38dc80e7233764a664b7226f0c26c464efa136dd78a9fa7b9c
- MD5 9bae518bc7173decb959a83a2f1d7d23
- SHA1 d663961330a6ec257a3293d88fea42436833c81d
- SHA512 591d083fc6e7b71f8b97be831de89839bb79f8faa3b16f66ba80cb1afb203571459edaf76b76135f139297b088424fd76d3f516a3d18ab0366d6e0fc54cfc347
- SSDEEP 49152:A3kM8ljouygmUSbHDUnxeW4SkZP4sz9Mbj:A3kM7UEwfkZcj
- TLSH T199D55B55F7B882B2E0B38175C9A69666FA727C420B308ACF0254E32D1E377D19E35736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory