General
- Target 2026-07-30_3fa4ee08cd53dda0a8d9eb59f991ed1e_amadey_cobalt-strike_elex_eternalromance_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop_tofsee_vidar_wannacry
- Size 9.3MB
- Sample260730-d6tkksyeqe
- SHA256 1eb83cb01dd58bd7dfdd0e346258c560200ef91a18d80e713340c5110b3af2c5
- MD5 3fa4ee08cd53dda0a8d9eb59f991ed1e
- SHA1 82865481d5a9b509d15e0ff3555b6606591ab41b
- SHA512 0a78cb9b3f3d46dd0d40c3d98b4a62e3b6ebaada00033136476b6f08deee811565ed5dfb54ab5d68ad434561e4948952b087025b3328af359330dda06e56fa13
- SSDEEP 98304:kIOu9joddSUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGawxQeMjLsAAGTIOSAR:Su5oddH66HtIto0ADHeGZhTfd
- TLSH T117A67D6532B3357DC31F597C406DCE33BA30282A5B518E7F6184EAB42D16B29991BB33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-30_3fa4ee08cd53dda0a8d9eb59f991ed1e_amadey_cobalt-strike_elex_eternalromance_glassworm_hijac.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_3fa4ee08cd53dda0a8d9eb59f991ed1e_amadey_cobalt-strike_elex_eternalromance_glassworm_hijac.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-30_3fa4ee08cd53dda0a8d9eb59f991ed1e_amadey_cobalt-strike_elex_eternalromance_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stop_tofsee_vidar_wannacry
- Size 9.3MB
- SHA256 1eb83cb01dd58bd7dfdd0e346258c560200ef91a18d80e713340c5110b3af2c5
- MD5 3fa4ee08cd53dda0a8d9eb59f991ed1e
- SHA1 82865481d5a9b509d15e0ff3555b6606591ab41b
- SHA512 0a78cb9b3f3d46dd0d40c3d98b4a62e3b6ebaada00033136476b6f08deee811565ed5dfb54ab5d68ad434561e4948952b087025b3328af359330dda06e56fa13
- SSDEEP 98304:kIOu9joddSUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGawxQeMjLsAAGTIOSAR:Su5oddH66HtIto0ADHeGZhTfd
- TLSH T117A67D6532B3357DC31F597C406DCE33BA30282A5B518E7F6184EAB42D16B29991BB33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory