General
- Target 2026-07-13_f8494df537738bc7f1e4fcddd271f60e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.2MB
- Sample260713-bc3kaacw2v
- SHA256 418bcf474b77a3ca6b6308994f3f7191cee66e3e0ccc40abeb120111618c493d
- MD5 f8494df537738bc7f1e4fcddd271f60e
- SHA1 dcf7f20bcfa835b043b7b70f327eec226b6e77a5
- SHA512 36ee12d6aef9c70a7db69599cfdca2e94d60fabde29b469d9066a0e17d42ff048dd8ebeaea763341775f28a83afe81bac9e2f8a822654e609e766d73b8362dcf
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjx9EaBfJ8EaLDZM9zFVSOS:A3kMPljoZM9zfu
- TLSH T1A655C023FBB054F5D63B45358A658B12E6757C210B6086CFA3A896191F333C06F3EB66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-13_f8494df537738bc7f1e4fcddd271f60e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-13_f8494df537738bc7f1e4fcddd271f60e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-13_f8494df537738bc7f1e4fcddd271f60e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.2MB
- SHA256 418bcf474b77a3ca6b6308994f3f7191cee66e3e0ccc40abeb120111618c493d
- MD5 f8494df537738bc7f1e4fcddd271f60e
- SHA1 dcf7f20bcfa835b043b7b70f327eec226b6e77a5
- SHA512 36ee12d6aef9c70a7db69599cfdca2e94d60fabde29b469d9066a0e17d42ff048dd8ebeaea763341775f28a83afe81bac9e2f8a822654e609e766d73b8362dcf
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjx9EaBfJ8EaLDZM9zFVSOS:A3kMPljoZM9zfu
- TLSH T1A655C023FBB054F5D63B45358A658B12E6757C210B6086CFA3A896191F333C06F3EB66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory