General
- Target 2026-08-02_e8849f0e392aa71cb28ca80e3b9eedf6_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar
- Size 1.5MB
- Sample260802-tvdmzscf44
- SHA256 319294a9c9af5875ac4b32cafa87a91f2af0d129d5ca043cbb90ed6a0b06d836
- MD5 e8849f0e392aa71cb28ca80e3b9eedf6
- SHA1 2673fd03a74d57359cdf3ed38c021659884761e5
- SHA512 fc2827dbe4fef0fbee06bb9c770629a42c65c95150b08e9b5b8bd659d0035bc0362c00154f46f8a0493a136ddd22145c4a8bff92f6f9e7c29ac8ed97b3b80f41
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc63xK0Le5ji0hmxNrM:A3kMPljfPji0Aj
- TLSH T19B759E22FA748275D077C4B5C6E2975AEA7134520B308ACB9398C76C2F237D19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-02_e8849f0e392aa71cb28ca80e3b9eedf6_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_e8849f0e392aa71cb28ca80e3b9eedf6_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_e8849f0e392aa71cb28ca80e3b9eedf6_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar
- Size 1.5MB
- SHA256 319294a9c9af5875ac4b32cafa87a91f2af0d129d5ca043cbb90ed6a0b06d836
- MD5 e8849f0e392aa71cb28ca80e3b9eedf6
- SHA1 2673fd03a74d57359cdf3ed38c021659884761e5
- SHA512 fc2827dbe4fef0fbee06bb9c770629a42c65c95150b08e9b5b8bd659d0035bc0362c00154f46f8a0493a136ddd22145c4a8bff92f6f9e7c29ac8ed97b3b80f41
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc63xK0Le5ji0hmxNrM:A3kMPljfPji0Aj
- TLSH T19B759E22FA748275D077C4B5C6E2975AEA7134520B308ACB9398C76C2F237D19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory