General
- Target 2026-07-31_fc7f6a858361ed2d1bcfbbae9885a4b7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 2.1MB
- Sample260731-tg3pysda83
- SHA256 a07a7b25eb18ae2d7e30522c2797a830f19f312c47541462d6e1e640a19baf03
- MD5 fc7f6a858361ed2d1bcfbbae9885a4b7
- SHA1 d22bfdba872fa9854a0b49ff3e0e2cfc75897710
- SHA512 8d9972f96be31b0231bdfcde19e9feb532326d1dfbcfa68d54dc84d6b4fa08947cd5c37c22174e695f6a71af63dd350575bf89b0eeaa6b7c4b5b637a515bbbe0
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjx9EaBubdYTqMi8CtBd2QHCHmTBW5MP0Le5ji0hmxNrM:A3kMPljBqJtb2IRPji0Aj
- TLSH T101A52916F6A48261D07B8075CBD2965AFA333C410BB08ACB52C5E77C2F376D19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-31_fc7f6a858361ed2d1bcfbbae9885a4b7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_fc7f6a858361ed2d1bcfbbae9885a4b7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_fc7f6a858361ed2d1bcfbbae9885a4b7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 2.1MB
- SHA256 a07a7b25eb18ae2d7e30522c2797a830f19f312c47541462d6e1e640a19baf03
- MD5 fc7f6a858361ed2d1bcfbbae9885a4b7
- SHA1 d22bfdba872fa9854a0b49ff3e0e2cfc75897710
- SHA512 8d9972f96be31b0231bdfcde19e9feb532326d1dfbcfa68d54dc84d6b4fa08947cd5c37c22174e695f6a71af63dd350575bf89b0eeaa6b7c4b5b637a515bbbe0
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjx9EaBubdYTqMi8CtBd2QHCHmTBW5MP0Le5ji0hmxNrM:A3kMPljBqJtb2IRPji0Aj
- TLSH T101A52916F6A48261D07B8075CBD2965AFA333C410BB08ACB52C5E77C2F376D19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory