General
- Target 2026-08-03_e7f32708f7b186d245bcaaaef6f0d9a7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.5MB
- Sample260803-fbl85aydpd
- SHA256 75f22d35307ea20966d5c47c27291806f3cc39d722d7d80c0738f6e99b999680
- MD5 e7f32708f7b186d245bcaaaef6f0d9a7
- SHA1 cd0aa47cbe6830c97b53b0535dbcfcafe2ef537e
- SHA512 568aa0695bef7dbc0721641a7606ce8847337ddbf230bfb6dfb34d1e293b9548fd8fceafe5545d7fdff5fc3a901073f3656b6e43278e6a24ace20484faed7a33
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aZlTZ0Le5ji0hmxNrM:A3kM8ljUPji0Aj
- TLSH T178758E22FA748275D077C4B5CAE2975AEA7534510B308ACB9398C76C2F237D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-03_e7f32708f7b186d245bcaaaef6f0d9a7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_e7f32708f7b186d245bcaaaef6f0d9a7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_e7f32708f7b186d245bcaaaef6f0d9a7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.5MB
- SHA256 75f22d35307ea20966d5c47c27291806f3cc39d722d7d80c0738f6e99b999680
- MD5 e7f32708f7b186d245bcaaaef6f0d9a7
- SHA1 cd0aa47cbe6830c97b53b0535dbcfcafe2ef537e
- SHA512 568aa0695bef7dbc0721641a7606ce8847337ddbf230bfb6dfb34d1e293b9548fd8fceafe5545d7fdff5fc3a901073f3656b6e43278e6a24ace20484faed7a33
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEp2aZlTZ0Le5ji0hmxNrM:A3kM8ljUPji0Aj
- TLSH T178758E22FA748275D077C4B5CAE2975AEA7534510B308ACB9398C76C2F237D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory