General
- Target 2026-07-19_52ef838fc073364b8ec4eadde9cb0d3a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_remcos_rhadamanthys_stealc_vidar_wannacry
- Size 14.7MB
- Sample260719-2lx92ahs81
- SHA256 7469a67f6505579189d2484d8bb870276265e376648a4301eb885de3951c0db8
- MD5 52ef838fc073364b8ec4eadde9cb0d3a
- SHA1 d5a7e74a8566aad10334a66c734956512d8837cc
- SHA512 49926da49833440027e425405702968decb2b3a358c93b62fe7480938fbb2325915e47a7a4e42b95f1c726ee8504639f5a30b946042975728a6d97400d4898c4
- SSDEEP 196608:8pAnjOyAdOrNTfgd7ozqda18U26IgTH2qBpu1QfLIqsufcBU:OAntR9NzTHNBpu1Qfc0WU
- TLSH T118F67C1262D58FA9D06F9038C9562AA596337C564F31DBCF2980BE293E327E05E3531F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-19_52ef838fc073364b8ec4eadde9cb0d3a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_52ef838fc073364b8ec4eadde9cb0d3a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-19_52ef838fc073364b8ec4eadde9cb0d3a_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_remcos_rhadamanthys_stealc_vidar_wannacry
- Size 14.7MB
- SHA256 7469a67f6505579189d2484d8bb870276265e376648a4301eb885de3951c0db8
- MD5 52ef838fc073364b8ec4eadde9cb0d3a
- SHA1 d5a7e74a8566aad10334a66c734956512d8837cc
- SHA512 49926da49833440027e425405702968decb2b3a358c93b62fe7480938fbb2325915e47a7a4e42b95f1c726ee8504639f5a30b946042975728a6d97400d4898c4
- SSDEEP 196608:8pAnjOyAdOrNTfgd7ozqda18U26IgTH2qBpu1QfLIqsufcBU:OAntR9NzTHNBpu1Qfc0WU
- TLSH T118F67C1262D58FA9D06F9038C9562AA596337C564F31DBCF2980BE293E327E05E3531F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Drops file in System32 directory