General
- Target 2026-07-28_6a76067adaa5936508d758c05531bddf_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry
- Size 4.2MB
- Sample260728-2sagjszvhs
- SHA256 d60d6997baf189b6c22fcf26ead007c0cc44c12f7bef53669fc4ba19ce8c2132
- MD5 6a76067adaa5936508d758c05531bddf
- SHA1 2440f69dbaba3e6b671a586e1199da03f579aee7
- SHA512 e2719aa9c01be7fd5b9f7e8e7bd8e4338307e7ae2b4638737acee24bee2e2f83bd02636daa33cbe6ac1c2012509c8847ab3aad1c811cbca4f6ccc6adc160edd6
- SSDEEP 49152:poRg5x6c1fHLfU5nRdHnWRHcfXb+N/7t0i0FZaUm8cikLuoRg5x6c1fHLfU5nRdE:+e5x6c1QVb6nUm8Ule5x6c1QVb
- TLSH T15016AE17F69444F5D17A99304A659332EB72BC120B31D7CB83A4F6192F336D0AE3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_6a76067adaa5936508d758c05531bddf_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_6a76067adaa5936508d758c05531bddf_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-28_6a76067adaa5936508d758c05531bddf_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry
- Size 4.2MB
- SHA256 d60d6997baf189b6c22fcf26ead007c0cc44c12f7bef53669fc4ba19ce8c2132
- MD5 6a76067adaa5936508d758c05531bddf
- SHA1 2440f69dbaba3e6b671a586e1199da03f579aee7
- SHA512 e2719aa9c01be7fd5b9f7e8e7bd8e4338307e7ae2b4638737acee24bee2e2f83bd02636daa33cbe6ac1c2012509c8847ab3aad1c811cbca4f6ccc6adc160edd6
- SSDEEP 49152:poRg5x6c1fHLfU5nRdHnWRHcfXb+N/7t0i0FZaUm8cikLuoRg5x6c1fHLfU5nRdE:+e5x6c1QVb6nUm8Ule5x6c1QVb
- TLSH T15016AE17F69444F5D17A99304A659332EB72BC120B31D7CB83A4F6192F336D0AE3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry