General
- Target 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_stealc_vidar_wannacry
- Size 10.8MB
- Sample260715-lr5cjacv7s
- SHA256 e57fe66b24a54b4c7ef690880047225f656b9b6175527885f5a72c07a4c962b2
- MD5 8893ca1f38955b0646fd48a75c231bfa
- SHA1 443ba1c1909b3c004c1d4b21e5746a3e1b756543
- SHA512 73a7c1ef73c2417e9c1fb5b40a134c95f1e71761897ca2047ff7bcb7fddf9edb2dde79c4bb93f4d3817114ad459750bcfd60b5d720949c7e193dc36d0c15e750
- SSDEEP 98304:EhpBinjOykGcPdOR5NTIOSAkdvjozRL61joULapIpfkZc/jol:cpAnjOyAdOrNTfgd7ozl6BoUcI1PLol
- TLSH T196B68E12B2E40237D0B69179CAA25729D7B13C794BB1C3CB7244B6DD2E737C1A936722
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-15_8893ca1f38955b0646fd48a75c231bfa_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_stealc_vidar_wannacry
- Size 10.8MB
- SHA256 e57fe66b24a54b4c7ef690880047225f656b9b6175527885f5a72c07a4c962b2
- MD5 8893ca1f38955b0646fd48a75c231bfa
- SHA1 443ba1c1909b3c004c1d4b21e5746a3e1b756543
- SHA512 73a7c1ef73c2417e9c1fb5b40a134c95f1e71761897ca2047ff7bcb7fddf9edb2dde79c4bb93f4d3817114ad459750bcfd60b5d720949c7e193dc36d0c15e750
- SSDEEP 98304:EhpBinjOykGcPdOR5NTIOSAkdvjozRL61joULapIpfkZc/jol:cpAnjOyAdOrNTfgd7ozl6BoUcI1PLol
- TLSH T196B68E12B2E40237D0B69179CAA25729D7B13C794BB1C3CB7244B6DD2E737C1A936722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Drops file in System32 directory