General
- Target 2026-08-02_d7aeec018f8966ce35001914d4ad228b_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop_vidar
- Size 3.5MB
- Sample260802-mq9fja1cle
- SHA256 0920bae537f8967455262912a7372699b53ba2fefae2fcc38a3e98864f137caa
- MD5 d7aeec018f8966ce35001914d4ad228b
- SHA1 1fdf905e114cf917cc30a3cbeeac4957f1f8458b
- SHA512 eba65b59d9e5d17182480c5ff16d33c36688c42ac44ff7ef9f53a4afc9aae64fbe93c312b1c4f0e206ae4daaaaf026016cb13e414e45ad54aef32904b6f0015b
- SSDEEP 49152:H9WXJ9OOEBith9cExSftT0MjL/gxkOjc9210qps/7UEK8mCBIRc0iw+k7U5kl/q2:H9YSk1xQeMjLsAAa/7JNzJwjI5klUiD
- TLSH T1CCF51211B7E88436F0F70B355CB5C2215A7ABD222F26C68F6785179E0A327D09A32377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_d7aeec018f8966ce35001914d4ad228b_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_d7aeec018f8966ce35001914d4ad228b_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-st.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_d7aeec018f8966ce35001914d4ad228b_amadey_cobalt-strike_elex_glassworm_hijackloader_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop_vidar
- Size 3.5MB
- SHA256 0920bae537f8967455262912a7372699b53ba2fefae2fcc38a3e98864f137caa
- MD5 d7aeec018f8966ce35001914d4ad228b
- SHA1 1fdf905e114cf917cc30a3cbeeac4957f1f8458b
- SHA512 eba65b59d9e5d17182480c5ff16d33c36688c42ac44ff7ef9f53a4afc9aae64fbe93c312b1c4f0e206ae4daaaaf026016cb13e414e45ad54aef32904b6f0015b
- SSDEEP 49152:H9WXJ9OOEBith9cExSftT0MjL/gxkOjc9210qps/7UEK8mCBIRc0iw+k7U5kl/q2:H9YSk1xQeMjLsAAa/7JNzJwjI5klUiD
- TLSH T1CCF51211B7E88436F0F70B355CB5C2215A7ABD222F26C68F6785179E0A327D09A32377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1