General
- Target 2026-08-02_a5ada1679c10ee764d5749e9f9aa0472_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 2.5MB
- Sample260802-vxdlfaxepa
- SHA256 3e2c7f6edde1bd0d19aa1875d45b932199ee8885709472260f181d54f01e3688
- MD5 a5ada1679c10ee764d5749e9f9aa0472
- SHA1 1197d5948375d1e05a652821b6c6c303313ed577
- SHA512 c64cc015beab9f24d19470c53965085a3bc88794133ef459a15957bd425d4e065efd02dc42588e5cac1e781a7c00605ea4b5f459b1bb2a7ba00be45390ed1bda
- SSDEEP 49152:A3kM8lj/eW4SkZP4sz9MbkqJtb2Ij56rX:A3kM2fkZckJrX
- TLSH T16FC53B16F6788732D077C0B9C5D2AA5AFA3238414F308BCB53459B6C3E276D19A36736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-02_a5ada1679c10ee764d5749e9f9aa0472_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_a5ada1679c10ee764d5749e9f9aa0472_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_a5ada1679c10ee764d5749e9f9aa0472_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 2.5MB
- SHA256 3e2c7f6edde1bd0d19aa1875d45b932199ee8885709472260f181d54f01e3688
- MD5 a5ada1679c10ee764d5749e9f9aa0472
- SHA1 1197d5948375d1e05a652821b6c6c303313ed577
- SHA512 c64cc015beab9f24d19470c53965085a3bc88794133ef459a15957bd425d4e065efd02dc42588e5cac1e781a7c00605ea4b5f459b1bb2a7ba00be45390ed1bda
- SSDEEP 49152:A3kM8lj/eW4SkZP4sz9MbkqJtb2Ij56rX:A3kM2fkZckJrX
- TLSH T16FC53B16F6788732D077C0B9C5D2AA5AFA3238414F308BCB53459B6C3E276D19A36736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory