General
- Target 2026-07-20_e280abdeb8ae8ec70aada0ea8982e321_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_stealc_vidar_wannacry
- Size 10.5MB
- Sample260720-h9pg9acx3t
- SHA256 0d5f09a2fbd1817b45dcadb1a8b9e5a339431652cd31845057fe3d74701c94f0
- MD5 e280abdeb8ae8ec70aada0ea8982e321
- SHA1 2abd437e8cf0dbbf1ba4ab5c8c7d59985cbb69f0
- SHA512 c408e2d7f17c7ad42bd5189d76e8bed1b415d79968a10d75245a486e5236d89b66cc4e14757eac5bb9185b21397a9dc80980b3690803a5f2bd89dddd2c9d0560
- SSDEEP 98304:lhpBinjOykGcPdOR5NTIOSAkdvjozRL61joULapIl3jom:TpAnjOyAdOrNTfgd7ozl6BoUcIlzom
- TLSH T120B68D12B2E04236D0B6917ACAA15729D7B13C794BB1C3CB7244B6DD2E737C1A937722
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-20_e280abdeb8ae8ec70aada0ea8982e321_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_e280abdeb8ae8ec70aada0ea8982e321_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_stealc_vidar_wannacry
- Size 10.5MB
- SHA256 0d5f09a2fbd1817b45dcadb1a8b9e5a339431652cd31845057fe3d74701c94f0
- MD5 e280abdeb8ae8ec70aada0ea8982e321
- SHA1 2abd437e8cf0dbbf1ba4ab5c8c7d59985cbb69f0
- SHA512 c408e2d7f17c7ad42bd5189d76e8bed1b415d79968a10d75245a486e5236d89b66cc4e14757eac5bb9185b21397a9dc80980b3690803a5f2bd89dddd2c9d0560
- SSDEEP 98304:lhpBinjOykGcPdOR5NTIOSAkdvjozRL61joULapIl3jom:TpAnjOyAdOrNTfgd7ozl6BoUcIlzom
- TLSH T120B68D12B2E04236D0B6917ACAA15729D7B13C794BB1C3CB7244B6DD2E737C1A937722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Drops file in System32 directory