General
- Target 2026-07-13_483522919f2017ec035e9531d8777d11_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_remcos_rhadamanthys_stealc_vidar_wannacry
- Size 12.7MB
- Sample260714-bvpq5set3z
- SHA256 62b71df18fdf0a4bfc77ecbd2c7e2185b68579910e83bd5dcfb99f5b2eddcecf
- MD5 483522919f2017ec035e9531d8777d11
- SHA1 c900f16846036a0c6d283d3758f28b97adc77823
- SHA512 4c4dbefac6798cebad33f0227a8e1cab367c28e76a41995935173697085269f638881cf983480d2a4883b8065c944694761f24334b754cba569cc7477b164eb6
- SSDEEP 196608:8pAnjOyAdOrNTfgd7ozlYgTH2qBpu1QfLIqsufc:OAntRdTHNBpu1Qfc0c
- TLSH T1F1D66B1222D58FADD06F9038C9162AA596237C568F31DBDF2980BD293E727E05E3531F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-13_483522919f2017ec035e9531d8777d11_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-13_483522919f2017ec035e9531d8777d11_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win11ltsc2024-20260710-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-13_483522919f2017ec035e9531d8777d11_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_remcos_rhadamanthys_stealc_vidar_wannacry
- Size 12.7MB
- SHA256 62b71df18fdf0a4bfc77ecbd2c7e2185b68579910e83bd5dcfb99f5b2eddcecf
- MD5 483522919f2017ec035e9531d8777d11
- SHA1 c900f16846036a0c6d283d3758f28b97adc77823
- SHA512 4c4dbefac6798cebad33f0227a8e1cab367c28e76a41995935173697085269f638881cf983480d2a4883b8065c944694761f24334b754cba569cc7477b164eb6
- SSDEEP 196608:8pAnjOyAdOrNTfgd7ozlYgTH2qBpu1QfLIqsufc:OAntRdTHNBpu1Qfc0c
- TLSH T1F1D66B1222D58FADD06F9038C9162AA596237C568F31DBDF2980BD293E727E05E3531F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Drops file in System32 directory