General
- Target 2026-08-02_1c5a4a5f4730cd218d650a73dfca7728_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_stealc_vidar_wannacry
- Size 26.4MB
- Sample260802-d3csnatcpg
- SHA256 e3de0b60418e3798b13b2ee4ac3f17a75d0abe4ffc71f80e1561f8fd46cf95e9
- MD5 1c5a4a5f4730cd218d650a73dfca7728
- SHA1 eec80a72fe025ff5ed37238604b790c9f281f44f
- SHA512 ca59fbf86b09c5c0966e98e027453f060d6279a6307a1baffc5bb843160588893763a637b8db7f4f1e5efe3d4e3966f8fc33e013d66b09c8a7a456ff62e086b6
- SSDEEP 196608:JtcIkGn+oKLtcIkGn+oK4tcIkGn+oKLtcIkGn+oKN:I5G+ob5G+oo5G+ob5G+og
- TLSH T14E576B16B6E440E5C1AAC134CF568632E7B17C294FF097EB6255B2C92E33AD07E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_1c5a4a5f4730cd218d650a73dfca7728_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_1c5a4a5f4730cd218d650a73dfca7728_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_1c5a4a5f4730cd218d650a73dfca7728_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_stealc_vidar_wannacry
- Size 26.4MB
- SHA256 e3de0b60418e3798b13b2ee4ac3f17a75d0abe4ffc71f80e1561f8fd46cf95e9
- MD5 1c5a4a5f4730cd218d650a73dfca7728
- SHA1 eec80a72fe025ff5ed37238604b790c9f281f44f
- SHA512 ca59fbf86b09c5c0966e98e027453f060d6279a6307a1baffc5bb843160588893763a637b8db7f4f1e5efe3d4e3966f8fc33e013d66b09c8a7a456ff62e086b6
- SSDEEP 196608:JtcIkGn+oKLtcIkGn+oK4tcIkGn+oKLtcIkGn+oKN:I5G+ob5G+oo5G+ob5G+og
- TLSH T14E576B16B6E440E5C1AAC134CF568632E7B17C294FF097EB6255B2C92E33AD07E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry