General
- Target 2026-07-15_4e571a4e78613ed29c53bf40d6dc7a50_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.6MB
- Sample260716-acbacsb13w
- SHA256 c7ba89bc992b604759d5b17f7a11ca32f603964c4ee025836aa668d7b8f218e2
- MD5 4e571a4e78613ed29c53bf40d6dc7a50
- SHA1 846800449e6c9b2b6e1ef4b414e29d9c2e0d7917
- SHA512 61622b54cff181a64528869bd225623de4f9d08196675ad35082905ed8c1410fa51ea4c11dc3d353c9e2205df8c51c7164fa98a6556fa45378ccf9883df5efd1
- SSDEEP 24576:A3mnXoZjzyaT4aewsqZe0p4Ek4niOkl/A04szE87JKTvmLB2+:A3kMPheW4SkZP4sz9MbN+
- TLSH T146753A26F6788333D0B3C0B9C5D6AB5AFA3234454B308ACB4359D76C2E276D19636739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-15_4e571a4e78613ed29c53bf40d6dc7a50_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_4e571a4e78613ed29c53bf40d6dc7a50_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Resource
win11ltsc2024-20260710-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-15_4e571a4e78613ed29c53bf40d6dc7a50_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.6MB
- SHA256 c7ba89bc992b604759d5b17f7a11ca32f603964c4ee025836aa668d7b8f218e2
- MD5 4e571a4e78613ed29c53bf40d6dc7a50
- SHA1 846800449e6c9b2b6e1ef4b414e29d9c2e0d7917
- SHA512 61622b54cff181a64528869bd225623de4f9d08196675ad35082905ed8c1410fa51ea4c11dc3d353c9e2205df8c51c7164fa98a6556fa45378ccf9883df5efd1
- SSDEEP 24576:A3mnXoZjzyaT4aewsqZe0p4Ek4niOkl/A04szE87JKTvmLB2+:A3kMPheW4SkZP4sz9MbN+
- TLSH T146753A26F6788333D0B3C0B9C5D6AB5AFA3234454B308ACB4359D76C2E276D19636739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory