General
- Target 2026-07-17_75d810673d4775e9c99d2198a66cc4db_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_stealc_vidar_wannacry
- Size 3.1MB
- Sample260718-dvx4mah17w
- SHA256 e767f6572e185950c0f9fb1966deaff51eef4ae82c21e996a0ebbda5b1e992a5
- MD5 75d810673d4775e9c99d2198a66cc4db
- SHA1 8c8766eaaf532b8fb9ba614e913c42f4701ba9be
- SHA512 b896e5c880d8de8b48660a49f78105f04a7c5857e817c2487dda3da109a473c3a92016d15ef105dd376845bcdef9d3c58fa6ca13946c89303e07ef9b893023cd
- SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mbq56r2uygmUSbHDUnT:A3k03kHRnfkZcHraUEW
- TLSH T13FE52A15A6B846B1E0778174C9A69669FA723C418F228FCF0244AF9D7FB36C09D35336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-17_75d810673d4775e9c99d2198a66cc4db_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_75d810673d4775e9c99d2198a66cc4db_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-17_75d810673d4775e9c99d2198a66cc4db_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_stealc_vidar_wannacry
- Size 3.1MB
- SHA256 e767f6572e185950c0f9fb1966deaff51eef4ae82c21e996a0ebbda5b1e992a5
- MD5 75d810673d4775e9c99d2198a66cc4db
- SHA1 8c8766eaaf532b8fb9ba614e913c42f4701ba9be
- SHA512 b896e5c880d8de8b48660a49f78105f04a7c5857e817c2487dda3da109a473c3a92016d15ef105dd376845bcdef9d3c58fa6ca13946c89303e07ef9b893023cd
- SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mbq56r2uygmUSbHDUnT:A3k03kHRnfkZcHraUEW
- TLSH T13FE52A15A6B846B1E0778174C9A69669FA723C418F228FCF0244AF9D7FB36C09D35336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory