General
- Target 2026-07-20_02dac4b763ac5cf6467861987ad97b7a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry
- Size 18.6MB
- Sample260720-2yvpnsav4v
- SHA256 b417dba5d6144087127b43e829e0603c41392237ba711646f90a2d1fee4ff9fd
- MD5 02dac4b763ac5cf6467861987ad97b7a
- SHA1 a05ec5d15a4e6db7572ab4dbb7cd391e3588a7dc
- SHA512 e7384432b6c42d7889ea83fa97c3b9ae22db2cb458239656741fc9c39cb7de941f7b052b3bdfdafa059a67a74a9886e0949ba46eb68f768517e3979d86bd3ff2
- SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm8u5x6M1pLapIkoq2VjnmmEu5x6M1pLapIkoq2Vjnm8ui:JtcIkGnetcIkGnz3tcIkGnetcIkGnzuD
- TLSH T1DC175C1672E440A5C299C134CF568732E3F17C298FF197EBA215B6CD2E336D07A3A616
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_02dac4b763ac5cf6467861987ad97b7a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_02dac4b763ac5cf6467861987ad97b7a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_02dac4b763ac5cf6467861987ad97b7a_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry
- Size 18.6MB
- SHA256 b417dba5d6144087127b43e829e0603c41392237ba711646f90a2d1fee4ff9fd
- MD5 02dac4b763ac5cf6467861987ad97b7a
- SHA1 a05ec5d15a4e6db7572ab4dbb7cd391e3588a7dc
- SHA512 e7384432b6c42d7889ea83fa97c3b9ae22db2cb458239656741fc9c39cb7de941f7b052b3bdfdafa059a67a74a9886e0949ba46eb68f768517e3979d86bd3ff2
- SSDEEP 98304:Su5x6M1pLapIkoq2Vjnm8u5x6M1pLapIkoq2VjnmmEu5x6M1pLapIkoq2Vjnm8ui:JtcIkGnetcIkGnz3tcIkGnetcIkGnzuD
- TLSH T1DC175C1672E440A5C299C134CF568732E3F17C298FF197EBA215B6CD2E336D07A3A616
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry