General
- Target 2026-08-01_2cb4b61030f48830778c67d0befd649a_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_rhadamanthys_stop_vidar_wannacry
- Size 23.0MB
- Sample260802-bfrbesbj6s
- SHA256 a31923224d12eb4685745e67b85794920278270efefef44266246f8e32df8bb7
- MD5 2cb4b61030f48830778c67d0befd649a
- SHA1 aa1e13ffbb975d63764dace254d6b831e38b8134
- SHA512 a138aa12f5976535e543142345503acf4ed6d0b65d0bfa576c8b8416cf4eef694f7fca95553a2df94c84aef9487f495a96ce5dc5594da8c739708f2df10e148a
- SSDEEP 393216:qaGbIfPR7yZ/K0ttYZTrExpgTHNBpu1Qfc0kTHNBpu1Qfc0Z:qaGiRyZ/K0ttYZTrExpaHNBpu1Qfc02l
- TLSH T12637391262E98FACD05FD034CE1666A19A237C468FB19BDF15407E693E726E06E3431F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-01_2cb4b61030f48830778c67d0befd649a_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_2cb4b61030f48830778c67d0befd649a_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackl.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_2cb4b61030f48830778c67d0befd649a_akira_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_rhadamanthys_stop_vidar_wannacry
- Size 23.0MB
- SHA256 a31923224d12eb4685745e67b85794920278270efefef44266246f8e32df8bb7
- MD5 2cb4b61030f48830778c67d0befd649a
- SHA1 aa1e13ffbb975d63764dace254d6b831e38b8134
- SHA512 a138aa12f5976535e543142345503acf4ed6d0b65d0bfa576c8b8416cf4eef694f7fca95553a2df94c84aef9487f495a96ce5dc5594da8c739708f2df10e148a
- SSDEEP 393216:qaGbIfPR7yZ/K0ttYZTrExpgTHNBpu1Qfc0kTHNBpu1Qfc0Z:qaGiRyZ/K0ttYZTrExpaHNBpu1Qfc02l
- TLSH T12637391262E98FACD05FD034CE1666A19A237C468FB19BDF15407E693E726E06E3431F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory