General
- Target 2026-07-28_6a252c31bbbfdb2c67e14e47e8ccc407_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
- Size 2.2MB
- Sample260728-p66qpaxbpg
- SHA256 495634f8177667f65c2b1a9baaa10e7952516ef318adc7094c6fc29f78c788ef
- MD5 6a252c31bbbfdb2c67e14e47e8ccc407
- SHA1 49630b8446a7eb03c2de7efab1bf56b1d7f6d175
- SHA512 d5ac3a4ee2387f39e36b3f2d4c69cdb8ac5d0ad6851d9853016b18f3f9d7765f0fbd0363a29307d2876ae876e24e99c86b7cc86eb3d1fa4fcce81aa5f4a91eca
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TLaoEaaL3N+tCn50ChWdArKtYTqMi8CtBd2QHf:A3kM8ljH8tDZqrK0qJtb2Ix
- TLSH T17AB57C12F7B482B1D077C175C6A28676FA7278410B309ACB5394D76D2F336E19E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-28_6a252c31bbbfdb2c67e14e47e8ccc407_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_6a252c31bbbfdb2c67e14e47e8ccc407_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-28_6a252c31bbbfdb2c67e14e47e8ccc407_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
- Size 2.2MB
- SHA256 495634f8177667f65c2b1a9baaa10e7952516ef318adc7094c6fc29f78c788ef
- MD5 6a252c31bbbfdb2c67e14e47e8ccc407
- SHA1 49630b8446a7eb03c2de7efab1bf56b1d7f6d175
- SHA512 d5ac3a4ee2387f39e36b3f2d4c69cdb8ac5d0ad6851d9853016b18f3f9d7765f0fbd0363a29307d2876ae876e24e99c86b7cc86eb3d1fa4fcce81aa5f4a91eca
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TLaoEaaL3N+tCn50ChWdArKtYTqMi8CtBd2QHf:A3kM8ljH8tDZqrK0qJtb2Ix
- TLSH T17AB57C12F7B482B1D077C175C6A28676FA7278410B309ACB5394D76D2F336E19E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory