General
- Target 2026-07-31_44c3dc691847fa7d7fdb301354b4e10f_amadey_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_stop_vidar
- Size 16.1MB
- Sample260801-by4pgavdrb
- SHA256 9c4e48a7246439a9036534cc50c228e63f74d9ee20a5a600e7e92adc921ea3b3
- MD5 44c3dc691847fa7d7fdb301354b4e10f
- SHA1 4613e024dc58509afc31956451fba561c447443b
- SHA512 12d4eb67da08aa876f4810683a834f03c6e78f29467f44f72629712097ccadf5175288db00aa8bccfbd530a8af801ebb4520798fffbabf065f381f0f0bb509d6
- SSDEEP 196608:HV0d8dseGZF6bUpMBF1p/kjRm4OWi2bAmHpn6F44IAWv1dBjZ1dJdf:H6IbUwF1VERmj2bAmHN6+JrvFp
- TLSH T1FC07BE5162E660F9E0BFE1398A768731E6727C130A31934F13BCD65A2F636506D29B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-07-31_44c3dc691847fa7d7fdb301354b4e10f_amadey_cobalt-strike_coinminer_elex_glassworm_hawkeye_hi.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_44c3dc691847fa7d7fdb301354b4e10f_amadey_cobalt-strike_coinminer_elex_glassworm_hawkeye_hi.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_44c3dc691847fa7d7fdb301354b4e10f_amadey_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_stop_vidar
- Size 16.1MB
- SHA256 9c4e48a7246439a9036534cc50c228e63f74d9ee20a5a600e7e92adc921ea3b3
- MD5 44c3dc691847fa7d7fdb301354b4e10f
- SHA1 4613e024dc58509afc31956451fba561c447443b
- SHA512 12d4eb67da08aa876f4810683a834f03c6e78f29467f44f72629712097ccadf5175288db00aa8bccfbd530a8af801ebb4520798fffbabf065f381f0f0bb509d6
- SSDEEP 196608:HV0d8dseGZF6bUpMBF1p/kjRm4OWi2bAmHpn6F44IAWv1dBjZ1dJdf:H6IbUwF1VERmj2bAmHN6+JrvFp
- TLSH T1FC07BE5162E660F9E0BFE1398A768731E6727C130A31934F13BCD65A2F636506D29B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
UPX dump on OEP (original entry point)
-
Drops file in System32 directory