General
- Target 2026-07-27_40c71a1e909a79d14804d6d2a8e8e2be_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry
- Size 11.2MB
- Sample260727-kffpcsygpd
- SHA256 9177e67acc774ac843280954fea1fd8d0fe4e2fa9f40b21412685461f891799a
- MD5 40c71a1e909a79d14804d6d2a8e8e2be
- SHA1 4e052b5d6b4527e9cff04f8371ee3f0d6e42562c
- SHA512 30e82d2ab9e9556f2199fc262284d4cead19f1863cef7975a0356294f5c7a7367f3433a23bc1f4d366c345937723b31d43e62a3475bbe6ee2c7f619925726c7a
- SSDEEP 98304:Su5x6M1uWQtZ/K0tGOFWVRuLftCTY0oAaldmdmnpz/h1+AR8oq2Vjnm9jo:JSWyZ/K0ttYVAAT1Kmd0x/h1+AiGnMo
- TLSH T173C67E13F2A441E5D0A6D174CE668632EB327C494BF1A6EF225077D92E33AD07B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_40c71a1e909a79d14804d6d2a8e8e2be_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_40c71a1e909a79d14804d6d2a8e8e2be_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-27_40c71a1e909a79d14804d6d2a8e8e2be_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry
- Size 11.2MB
- SHA256 9177e67acc774ac843280954fea1fd8d0fe4e2fa9f40b21412685461f891799a
- MD5 40c71a1e909a79d14804d6d2a8e8e2be
- SHA1 4e052b5d6b4527e9cff04f8371ee3f0d6e42562c
- SHA512 30e82d2ab9e9556f2199fc262284d4cead19f1863cef7975a0356294f5c7a7367f3433a23bc1f4d366c345937723b31d43e62a3475bbe6ee2c7f619925726c7a
- SSDEEP 98304:Su5x6M1uWQtZ/K0tGOFWVRuLftCTY0oAaldmdmnpz/h1+AR8oq2Vjnm9jo:JSWyZ/K0ttYVAAT1Kmd0x/h1+AiGnMo
- TLSH T173C67E13F2A441E5D0A6D174CE668632EB327C494BF1A6EF225077D92E33AD07B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry