General
- Target 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_stealc_vidar_wannacry
- Size 9.0MB
- Sample260802-3lqevsyxbv
- SHA256 fef88a98af36e09fa0c753c550c8db9b52187e8c89b25f33692f37bda21dc3a0
- MD5 d5be56d6e75d429a94c75f73b0ae0f9e
- SHA1 a43e556344ad4dcb45ca39a089d48e01068d8198
- SHA512 c33374ad8071e0c242b03325b560d59a4339056c7c0e9c42e1a59f334c0d06c5223f63a1e1f4ac4010b22857fc32cfc50b5470185694bf30915f6830e8154ac5
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRLL6kLapIO:8pAnjOyAdOrNTfgd7ozlL6kcIO
- TLSH T15BA67C1272E00137E0AA917ACA65472597B13C7A8BF2C3DB7244B5DA1E737C17A36723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_d5be56d6e75d429a94c75f73b0ae0f9e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_stealc_vidar_wannacry
- Size 9.0MB
- SHA256 fef88a98af36e09fa0c753c550c8db9b52187e8c89b25f33692f37bda21dc3a0
- MD5 d5be56d6e75d429a94c75f73b0ae0f9e
- SHA1 a43e556344ad4dcb45ca39a089d48e01068d8198
- SHA512 c33374ad8071e0c242b03325b560d59a4339056c7c0e9c42e1a59f334c0d06c5223f63a1e1f4ac4010b22857fc32cfc50b5470185694bf30915f6830e8154ac5
- SSDEEP 98304:khpBinjOykGcPdOR5NTIOSAkdvjozRLL6kLapIO:8pAnjOyAdOrNTfgd7ozlL6kcIO
- TLSH T15BA67C1272E00137E0AA917ACA65472597B13C7A8BF2C3DB7244B5DA1E737C17A36723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Drops file in System32 directory