General
- Target 2026-07-15_f626bf2fba20dba43e2d45dfc60b0726_amadey_cobalt-strike_conti_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 955KB
- Sample260715-tvsf5sbz2v
- SHA256 d6fd1edfd1343ab8cc820b7b03d00f8eca4fb297f719a66c11c0da7ae47e2341
- MD5 f626bf2fba20dba43e2d45dfc60b0726
- SHA1 330adaa750ca18db66daf0f346625e5670e34e26
- SHA512 f3691df226405e9c928c88e3533758fe18b49cf2232ed1358a1cbaa6283634d8eda01220712e83a05f4b504adfe099adbd8d997e5f2ca7d428b38b1f5caa4e05
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsvMD3JeU7vinrmy3a:A3mnXoZjzyaT4aewsvMD5Tvinrmy3a
- TLSH T133258D22E6649FB5C27F45748A618622E7377C210F205BCB93A4AE653F316D06F3A713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-15_f626bf2fba20dba43e2d45dfc60b0726_amadey_cobalt-strike_conti_elex_glassworm_hawkeye_hijack.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_f626bf2fba20dba43e2d45dfc60b0726_amadey_cobalt-strike_conti_elex_glassworm_hawkeye_hijack.exe
Resource
win11ltsc2024-20260710-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-15_f626bf2fba20dba43e2d45dfc60b0726_amadey_cobalt-strike_conti_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 955KB
- SHA256 d6fd1edfd1343ab8cc820b7b03d00f8eca4fb297f719a66c11c0da7ae47e2341
- MD5 f626bf2fba20dba43e2d45dfc60b0726
- SHA1 330adaa750ca18db66daf0f346625e5670e34e26
- SHA512 f3691df226405e9c928c88e3533758fe18b49cf2232ed1358a1cbaa6283634d8eda01220712e83a05f4b504adfe099adbd8d997e5f2ca7d428b38b1f5caa4e05
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aTvAwSfxL/2Dc3jDLLmt0LDQewsvMD3JeU7vinrmy3a:A3mnXoZjzyaT4aewsvMD5Tvinrmy3a
- TLSH T133258D22E6649FB5C27F45748A618622E7377C210F205BCB93A4AE653F316D06F3A713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory