General
- Target 2026-08-02_19d38422bc4c6cfd594e7d8301cd03dc_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader_stop_vidar
- Size 6.1MB
- Sample260802-k2drwsfr3w
- SHA256 5ee5d4d43a338e77c3f6a97c76352d784fe3ba04adc9d33a1d0180e9b65e118a
- MD5 19d38422bc4c6cfd594e7d8301cd03dc
- SHA1 eb7f4c97c037d8be9248de3181734c24a7ce83f0
- SHA512 fb31af0231807dd5ce79ee3c85b414d92c7b2104bac97aa5aeffa5a063d1b97e7df9b2aa7817a9dab569868951552ad9a92b13ddb6e1762416628c4ce8171e07
- SSDEEP 98304:4AEqUeh9Fchv7StiJdXN0B7+s1Cs1CjoI5mJrX:4eJ9ovUutoI5m9X
- TLSH T1AB566B19FBE48A35E0B38675C9B59359AA727C204F3186CF2280761D9E72FC19936733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-02_19d38422bc4c6cfd594e7d8301cd03dc_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_19d38422bc4c6cfd594e7d8301cd03dc_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_19d38422bc4c6cfd594e7d8301cd03dc_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hawkeye_hijackloader_luca-stealer_njrat_rhadamanthys_smoke-loader_stop_vidar
- Size 6.1MB
- SHA256 5ee5d4d43a338e77c3f6a97c76352d784fe3ba04adc9d33a1d0180e9b65e118a
- MD5 19d38422bc4c6cfd594e7d8301cd03dc
- SHA1 eb7f4c97c037d8be9248de3181734c24a7ce83f0
- SHA512 fb31af0231807dd5ce79ee3c85b414d92c7b2104bac97aa5aeffa5a063d1b97e7df9b2aa7817a9dab569868951552ad9a92b13ddb6e1762416628c4ce8171e07
- SSDEEP 98304:4AEqUeh9Fchv7StiJdXN0B7+s1Cs1CjoI5mJrX:4eJ9ovUutoI5m9X
- TLSH T1AB566B19FBE48A35E0B38675C9B59359AA727C204F3186CF2280761D9E72FC19936733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory