General
- Target 2026-07-17_79feee003c696e1b459c627711849bbb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar
- Size 9.3MB
- Sample260717-xla3aaft6z
- SHA256 54978210419d73b9e699f32a901d2e9a8384ead21d47333bb80d07838bf7bc90
- MD5 79feee003c696e1b459c627711849bbb
- SHA1 83dd3876e0ef98e0939a30626164424644f7b141
- SHA512 64b3dc4083d1e1dcc21f4179d25cd6d1cae66af2bab8206535bb1f3d52e07ede2a00ca1a257e3d2b1055f3931ee07ee543c2aab0c3333748608658b7dfaa06f0
- SSDEEP 196608:Jw/h1+Qw/h1+8w/h1+Qw/h1+RjRUZ/K0t6rXld6r:YjaZ/K0t6r16
- TLSH T111A67C56F5A081B2D076C474C5D6A776EA32BC411B308BCB9346E72C2E376D09E3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_79feee003c696e1b459c627711849bbb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_79feee003c696e1b459c627711849bbb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-17_79feee003c696e1b459c627711849bbb_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar
- Size 9.3MB
- SHA256 54978210419d73b9e699f32a901d2e9a8384ead21d47333bb80d07838bf7bc90
- MD5 79feee003c696e1b459c627711849bbb
- SHA1 83dd3876e0ef98e0939a30626164424644f7b141
- SHA512 64b3dc4083d1e1dcc21f4179d25cd6d1cae66af2bab8206535bb1f3d52e07ede2a00ca1a257e3d2b1055f3931ee07ee543c2aab0c3333748608658b7dfaa06f0
- SSDEEP 196608:Jw/h1+Qw/h1+8w/h1+Qw/h1+RjRUZ/K0t6rXld6r:YjaZ/K0t6r16
- TLSH T111A67C56F5A081B2D076C474C5D6A776EA32BC411B308BCB9346E72C2E376D09E3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry