General
- Target 2026-08-01_e1488b2d6fb3f01731cbe41b60946b87_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar
- Size 1.4MB
- Sample260801-s2lrhazbnb
- SHA256 f0134a8d9189f9c68e3d87c91ddd55ed61ab94b269e1ee6b219c284730ac2b99
- MD5 e1488b2d6fb3f01731cbe41b60946b87
- SHA1 35d484e93f4843ce8495449b294b7c6d1a23fb06
- SHA512 56a084c2c40e5f04edc8474e6d4643c109eed9543d4492de4e4b826f8ee443851da071f25bea5345b76e927380e0cccc0de0a800ddb38d2711bd1c7ce2aadbc9
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjJzyki8CD5TvinrmrD:A3kMPljJG56rU
- TLSH T150651612E6A45AA5C26F4134CB558612B6377C610FE04BDB52E4FE3D3F322D06AFA613
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-01_e1488b2d6fb3f01731cbe41b60946b87_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_e1488b2d6fb3f01731cbe41b60946b87_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_e1488b2d6fb3f01731cbe41b60946b87_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar
- Size 1.4MB
- SHA256 f0134a8d9189f9c68e3d87c91ddd55ed61ab94b269e1ee6b219c284730ac2b99
- MD5 e1488b2d6fb3f01731cbe41b60946b87
- SHA1 35d484e93f4843ce8495449b294b7c6d1a23fb06
- SHA512 56a084c2c40e5f04edc8474e6d4643c109eed9543d4492de4e4b826f8ee443851da071f25bea5345b76e927380e0cccc0de0a800ddb38d2711bd1c7ce2aadbc9
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjJzyki8CD5TvinrmrD:A3kMPljJG56rU
- TLSH T150651612E6A45AA5C26F4134CB558612B6377C610FE04BDB52E4FE3D3F322D06AFA613
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory