General
- Target 2026-07-31_4f5cf5b662bcfd37e7fb79c28b74d628_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader_stop_vidar_wannacry
- Size 6.9MB
- Sample260731-1azs2sstfs
- SHA256 76891d2c153d10225eb2356382c223d214ba48433c0678c8771eb1a7b72a4928
- MD5 4f5cf5b662bcfd37e7fb79c28b74d628
- SHA1 e1e7ea8a8d00394e9369207ed0d72a7bf7e03136
- SHA512 3b3e02f9f870b10cac39579eef760d7af67d27fbe4df5854cf0878dbe393b46c89d5a63c520a087bfe5c61e6792c3a8ec9faafca3ff11bcb42f07a84f20b9533
- SSDEEP 98304:TAEqUeh9Fchv7StiJdXN0B7+s1Cs1Cjospr7fkZc86:TeJ9ovUutoazP86
- TLSH T1F8765B19FAB48A32E0B38175C9A69359EA727C514F3186CF1280772D9E32FD19A35733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-31_4f5cf5b662bcfd37e7fb79c28b74d628_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_4f5cf5b662bcfd37e7fb79c28b74d628_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_4f5cf5b662bcfd37e7fb79c28b74d628_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader_stop_vidar_wannacry
- Size 6.9MB
- SHA256 76891d2c153d10225eb2356382c223d214ba48433c0678c8771eb1a7b72a4928
- MD5 4f5cf5b662bcfd37e7fb79c28b74d628
- SHA1 e1e7ea8a8d00394e9369207ed0d72a7bf7e03136
- SHA512 3b3e02f9f870b10cac39579eef760d7af67d27fbe4df5854cf0878dbe393b46c89d5a63c520a087bfe5c61e6792c3a8ec9faafca3ff11bcb42f07a84f20b9533
- SSDEEP 98304:TAEqUeh9Fchv7StiJdXN0B7+s1Cs1Cjospr7fkZc86:TeJ9ovUutoazP86
- TLSH T1F8765B19FAB48A32E0B38175C9A69359EA727C514F3186CF1280772D9E32FD19A35733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory