General
- Target 2026-07-23_ad7a5a152e34308fa6b536b6505c7a4f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.4MB
- Sample260723-va698sgk4z
- SHA256 d7dcac52f899ea0767514ed02a7560a8d4cd8941d22af6d388ea0675bdcab961
- MD5 ad7a5a152e34308fa6b536b6505c7a4f
- SHA1 eb9b7fafbd7ce24c4e9a58fe85b2b0d0c48ab849
- SHA512 cee2395da40d891fa8a5e66fa68a8af93e67c9e24f12be69e800e57c9aa11bfd29e64a916d3b4adddc03e78de434a7378981b7e9a97bc9dadadaff8d9c532573
- SSDEEP 24576:A3mnXoZjzyaEFyKUJmaewsAjlF45jcAkSYqyEd:A3kMjKmljipYq9
- TLSH T193658D22FB748171D077C5B5CAE29756EA3538510B308ACB9398D7682F237D19B3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-23_ad7a5a152e34308fa6b536b6505c7a4f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_ad7a5a152e34308fa6b536b6505c7a4f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_ad7a5a152e34308fa6b536b6505c7a4f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.4MB
- SHA256 d7dcac52f899ea0767514ed02a7560a8d4cd8941d22af6d388ea0675bdcab961
- MD5 ad7a5a152e34308fa6b536b6505c7a4f
- SHA1 eb9b7fafbd7ce24c4e9a58fe85b2b0d0c48ab849
- SHA512 cee2395da40d891fa8a5e66fa68a8af93e67c9e24f12be69e800e57c9aa11bfd29e64a916d3b4adddc03e78de434a7378981b7e9a97bc9dadadaff8d9c532573
- SSDEEP 24576:A3mnXoZjzyaEFyKUJmaewsAjlF45jcAkSYqyEd:A3kMjKmljipYq9
- TLSH T193658D22FB748171D077C5B5CAE29756EA3538510B308ACB9398D7682F237D19B3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory