General
- Target 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_smoke-loader_stealc_vidar_wannacry
- Size 14.3MB
- Sample260723-1c6dlsdc44
- SHA256 0f5fd980daa85ec7da06ded74edbc8d01bd6a5f6c580db9ea1743ee7fa0b612d
- MD5 8efd466076f9d63946928bccf24c5217
- SHA1 e80792600f53169e1e8e256689688871816acfa2
- SHA512 7f6465174c2c8be5f3691953ddb00f026f6fa230f1dc2332148d4635a7de370e5d96ebbe9e7f43ef792633ebb2344718a357b7cfaeb0bf7362f50d5c6748c6ea
- SSDEEP 196608:8pdyn8OyJgV9z8bdsosEU8IBtz/WyZ/K0ttYVAATm6qTfRo7:OdyndVosEU8IBJuyZ/K0ttYZThOW7
- TLSH T150E6AE13F2E401B5E0AAD27DC9714632D7717C2A4BB193CF2250B6E91E73BD16A39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_8efd466076f9d63946928bccf24c5217_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_smoke-loader_stealc_vidar_wannacry
- Size 14.3MB
- SHA256 0f5fd980daa85ec7da06ded74edbc8d01bd6a5f6c580db9ea1743ee7fa0b612d
- MD5 8efd466076f9d63946928bccf24c5217
- SHA1 e80792600f53169e1e8e256689688871816acfa2
- SHA512 7f6465174c2c8be5f3691953ddb00f026f6fa230f1dc2332148d4635a7de370e5d96ebbe9e7f43ef792633ebb2344718a357b7cfaeb0bf7362f50d5c6748c6ea
- SSDEEP 196608:8pdyn8OyJgV9z8bdsosEU8IBtz/WyZ/K0ttYVAATm6qTfRo7:OdyndVosEU8IBJuyZ/K0ttYZThOW7
- TLSH T150E6AE13F2E401B5E0AAD27DC9714632D7717C2A4BB193CF2250B6E91E73BD16A39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detects executables containing URLs to raw contents of a Github gist
- Custom signature
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Custom signature
UPX dump on OEP (original entry point)
Drops file in System32 directory