General
- Target 2026-07-20_1f4cc7df41ed9e4935967e412e1e6222_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawkeye_hijackloader_icedid_njrat_remcos_smoke-loader_stealc_vidar
- Size 50.9MB
- Sample260720-me7gsshs41
- SHA256 3c37e9a101c26e59c92b17e7f7ed76642ce1c5a3ba5857d05716863deebf0093
- MD5 1f4cc7df41ed9e4935967e412e1e6222
- SHA1 2e8c704f9183b8be0321d3e13065f1d85f7d1c29
- SHA512 cb3fa6d7865a8a26eefa1680539d906bc07cd4987bcf1ed0a6e20a4c6923a0fc5dec439fe8ea2cfe7e92dce4e05079995b15a0d1bc181c287023f2ad69772d4c
- SSDEEP 393216:2cD2cD/cDuUEB2cD/cDuUEtQevvqc2W1cpV2XI32fD:tZ41Ef41E8c23pV2X+q
- TLSH T168C77B52BAE443E2D3AA953485B68272EB717C1E1B3197BB4278F21E1F336D05D39321
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_1f4cc7df41ed9e4935967e412e1e6222_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_1f4cc7df41ed9e4935967e412e1e6222_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawk.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_1f4cc7df41ed9e4935967e412e1e6222_amadey_cobalt-strike_darkgate_elex_emotet_glassworm_hawkeye_hijackloader_icedid_njrat_remcos_smoke-loader_stealc_vidar
- Size 50.9MB
- SHA256 3c37e9a101c26e59c92b17e7f7ed76642ce1c5a3ba5857d05716863deebf0093
- MD5 1f4cc7df41ed9e4935967e412e1e6222
- SHA1 2e8c704f9183b8be0321d3e13065f1d85f7d1c29
- SHA512 cb3fa6d7865a8a26eefa1680539d906bc07cd4987bcf1ed0a6e20a4c6923a0fc5dec439fe8ea2cfe7e92dce4e05079995b15a0d1bc181c287023f2ad69772d4c
- SSDEEP 393216:2cD2cD/cDuUEB2cD/cDuUEtQevvqc2W1cpV2XI32fD:tZ41Ef41E8c23pV2X+q
- TLSH T168C77B52BAE443E2D3AA953485B68272EB717C1E1B3197BB4278F21E1F336D05D39321
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry