General
- Target 2026-07-20_7d9beace80c1a5f2738c426f4e1c94ae_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.5MB
- Sample260720-s8stdsgz6s
- SHA256 18248c37b5aaa47a508f328e45237e093326e3927b82ee192eb26ac0c77b8b20
- MD5 7d9beace80c1a5f2738c426f4e1c94ae
- SHA1 df64d7fa04f7359fa3403ea237b983f843b95874
- SHA512 41ae106abebf121506759817ebd5928b75bbb61d5b0f3c062c48f945b759d2933443fa5ace302c7ab5c30f890668d05427a374c8cdd87e5ffbdbea8c8a45b08c
- SSDEEP 24576:A3mnXoZjzyaTjBaewsAjmEguMD5Tvinrmh5jcAkSYqyE:A3kM0lj256rapYq
- TLSH T1AC756B12F6648B75D07F8075CAA29656EA333C510F304BCB5394AE693F336D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-20_7d9beace80c1a5f2738c426f4e1c94ae_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_7d9beace80c1a5f2738c426f4e1c94ae_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260710-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_7d9beace80c1a5f2738c426f4e1c94ae_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.5MB
- SHA256 18248c37b5aaa47a508f328e45237e093326e3927b82ee192eb26ac0c77b8b20
- MD5 7d9beace80c1a5f2738c426f4e1c94ae
- SHA1 df64d7fa04f7359fa3403ea237b983f843b95874
- SHA512 41ae106abebf121506759817ebd5928b75bbb61d5b0f3c062c48f945b759d2933443fa5ace302c7ab5c30f890668d05427a374c8cdd87e5ffbdbea8c8a45b08c
- SSDEEP 24576:A3mnXoZjzyaTjBaewsAjmEguMD5Tvinrmh5jcAkSYqyE:A3kM0lj256rapYq
- TLSH T1AC756B12F6648B75D07F8075CAA29656EA333C510F304BCB5394AE693F336D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory