General
- Target 2026-07-20_5fadc16598e2ba82a78d913a8166a6e7_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_stealc_vidar_wannacry
- Size 10.5MB
- Sample260720-ls1ezags8t
- SHA256 60561e1bb5c2752533701fefb2a81b1b8a2da135fac13e1fd131bca5a06b4c13
- MD5 5fadc16598e2ba82a78d913a8166a6e7
- SHA1 77f16326a944efe8d662c5c1053da2f7d8ce84cc
- SHA512 e5ccf66ef3a97ccfce9afec1671b31fbd55234096aed6f7a4756ac3c449adc644314096d5a5a22be79d080a43f5ab2d0acc8ac06ebd81de9c5716f09d3a202f4
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRL61joULapIl3jo8:8pAnjOyAdOrNTfgd7ozl6BoUcIlzo8
- TLSH T191B68D12B2E04236D0B6917ACAA15729D7B13C794BB1C3CB7244B6DD2E737C1A937722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-20_5fadc16598e2ba82a78d913a8166a6e7_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_5fadc16598e2ba82a78d913a8166a6e7_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_5fadc16598e2ba82a78d913a8166a6e7_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_stealc_vidar_wannacry
- Size 10.5MB
- SHA256 60561e1bb5c2752533701fefb2a81b1b8a2da135fac13e1fd131bca5a06b4c13
- MD5 5fadc16598e2ba82a78d913a8166a6e7
- SHA1 77f16326a944efe8d662c5c1053da2f7d8ce84cc
- SHA512 e5ccf66ef3a97ccfce9afec1671b31fbd55234096aed6f7a4756ac3c449adc644314096d5a5a22be79d080a43f5ab2d0acc8ac06ebd81de9c5716f09d3a202f4
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRL61joULapIl3jo8:8pAnjOyAdOrNTfgd7ozl6BoUcIlzo8
- TLSH T191B68D12B2E04236D0B6917ACAA15729D7B13C794BB1C3CB7244B6DD2E737C1A937722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Drops file in System32 directory