General
- Target 2026-07-12_e097a31cefa6d5d825b2a10d5c245fd9_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.8MB
- Sample260712-j493faew2m
- SHA256 012883d199d30e469d5fdf579d64c850fa04572a1bea32b3d8f0044cefaf9f48
- MD5 e097a31cefa6d5d825b2a10d5c245fd9
- SHA1 46c140ee8d4ad48b5b6a84e0a353362ab71f14b2
- SHA512 e3e1c38aef0ae226abbdb6e633e8f501fbdf5af59c42af7c7d549e7b988c130f58778d398d1c289e8c140d9126697b4f7d27591b3939f9ddd5e6da9c6659edc2
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TLaaK0LCD5Tvinrmh5jcAkSYqyE:A3kM8lj956rapYq
- TLSH T1E6953912E6A48A61C16F8074CB929656FA333C510FA04BCB53D4FA7D3F326D19AB5723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-12_e097a31cefa6d5d825b2a10d5c245fd9_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_e097a31cefa6d5d825b2a10d5c245fd9_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-12_e097a31cefa6d5d825b2a10d5c245fd9_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.8MB
- SHA256 012883d199d30e469d5fdf579d64c850fa04572a1bea32b3d8f0044cefaf9f48
- MD5 e097a31cefa6d5d825b2a10d5c245fd9
- SHA1 46c140ee8d4ad48b5b6a84e0a353362ab71f14b2
- SHA512 e3e1c38aef0ae226abbdb6e633e8f501fbdf5af59c42af7c7d549e7b988c130f58778d398d1c289e8c140d9126697b4f7d27591b3939f9ddd5e6da9c6659edc2
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TLaaK0LCD5Tvinrmh5jcAkSYqyE:A3kM8lj956rapYq
- TLSH T1E6953912E6A48A61C16F8074CB929656FA333C510FA04BCB53D4FA7D3F326D19AB5723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory