General
- Target 2026-07-19_6c290b3c9b7e35869060e9f73f4fa2bd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 1.2MB
- Sample260720-bp6gpsdy7x
- SHA256 1ed4fbb0a41a708cdccf7e50668b3ff6ed777b449723204daae0dfa9f9962c1f
- MD5 6c290b3c9b7e35869060e9f73f4fa2bd
- SHA1 797ab76e3e4f91b93adf2c457ed67c09b51acce0
- SHA512 51c21dcd48e07f759386db6d0fb61b3a19d7ffeee8c7b2ce24674378ccae7df782e7088c5356e3bb5a8d3b0dc142ae8a049aa12ed89a5334d63e8d0770620c73
- SSDEEP 12288:N+IMYmIjE7jAwSfxL/2Dc3jDLLmt0LDQewsAjRYyqXZNYVLeyUji0h90ZD0wxpGt:N+I87caewsAj6ye0Le5ji0hmxNrM
- TLSH T154455B21F6B48332D1B38475C9E6974AE9353D810B3089CB9398B76D6E337D29636732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_6c290b3c9b7e35869060e9f73f4fa2bd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_6c290b3c9b7e35869060e9f73f4fa2bd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-19_6c290b3c9b7e35869060e9f73f4fa2bd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stealc_stop
- Size 1.2MB
- SHA256 1ed4fbb0a41a708cdccf7e50668b3ff6ed777b449723204daae0dfa9f9962c1f
- MD5 6c290b3c9b7e35869060e9f73f4fa2bd
- SHA1 797ab76e3e4f91b93adf2c457ed67c09b51acce0
- SHA512 51c21dcd48e07f759386db6d0fb61b3a19d7ffeee8c7b2ce24674378ccae7df782e7088c5356e3bb5a8d3b0dc142ae8a049aa12ed89a5334d63e8d0770620c73
- SSDEEP 12288:N+IMYmIjE7jAwSfxL/2Dc3jDLLmt0LDQewsAjRYyqXZNYVLeyUji0h90ZD0wxpGt:N+I87caewsAj6ye0Le5ji0hmxNrM
- TLSH T154455B21F6B48332D1B38475C9E6974AE9353D810B3089CB9398B76D6E337D29636732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory