General
- Target 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 2.7MB
- Sample260716-chvbjaet51
- SHA256 0efa6ed66092f18a5b395a1b06e99a6df22145901215e4c7a61d5f5c41460e38
- MD5 2d4e3ec304c0688cbe7b21ad99e5bb2e
- SHA1 91216aded384496d62554a43f828a369ffcb4a69
- SHA512 c98b88ead875aea80a7344d6c1a7bd05d6e2d5a6d57b69dc4dd5a98597da99dfec99e9c205520e4043278aa1231cb90801e9f68c3b81ec68bac81324a6606e7d
- SSDEEP 49152:A3kMjKmljkeW4SkZP4sz9MbmeW4SkZP4sz9Mb:A3kMjK3fkZc+fkZc
- TLSH T19BD51916F6788323D0BBC0B9C6D6AA59FA3334455B708ACB0285D73C2F276D18676736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-15_2d4e3ec304c0688cbe7b21ad99e5bb2e_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 2.7MB
- SHA256 0efa6ed66092f18a5b395a1b06e99a6df22145901215e4c7a61d5f5c41460e38
- MD5 2d4e3ec304c0688cbe7b21ad99e5bb2e
- SHA1 91216aded384496d62554a43f828a369ffcb4a69
- SHA512 c98b88ead875aea80a7344d6c1a7bd05d6e2d5a6d57b69dc4dd5a98597da99dfec99e9c205520e4043278aa1231cb90801e9f68c3b81ec68bac81324a6606e7d
- SSDEEP 49152:A3kMjKmljkeW4SkZP4sz9MbmeW4SkZP4sz9Mb:A3kMjK3fkZc+fkZc
- TLSH T19BD51916F6788323D0BBC0B9C6D6AA59FA3334455B708ACB0285D73C2F276D18676736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory