General
- Target 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_rhadamanthys_smoke-loader_stop_tofsee_vidar_wannacry
- Size 11.7MB
- Sample260803-vjnjgstdrc
- SHA256 80d68c29bf283f2f6912551139968c3158a1bc8e89e7022412d366357c641fbc
- MD5 bebfabf43387a40ff61f01de3bfd12b2
- SHA1 abd0f4af2eb93f331d958064c9bcaae3d69e0c10
- SHA512 bdf16ce8010b6b3ddf295e68d0b9a2762b956d6664096c74852a6ca7eb3176ea846765aecd0861e80d49bd1c8bd648d58a73317c5c345d488d76305c55ea9f67
- SSDEEP 98304:kIOERqd/6hkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0E4jovLapID6bTIOSAB:SEYd/6ZJEul4szEonqtaovcID6bTfV
- TLSH T103C69E3275D58136D1664135CAA56FB4C3A47C3A4BF182CB76807AEE5A723C27D32B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_bebfabf43387a40ff61f01de3bfd12b2_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_rhadamanthys_smoke-loader_stop_tofsee_vidar_wannacry
- Size 11.7MB
- SHA256 80d68c29bf283f2f6912551139968c3158a1bc8e89e7022412d366357c641fbc
- MD5 bebfabf43387a40ff61f01de3bfd12b2
- SHA1 abd0f4af2eb93f331d958064c9bcaae3d69e0c10
- SHA512 bdf16ce8010b6b3ddf295e68d0b9a2762b956d6664096c74852a6ca7eb3176ea846765aecd0861e80d49bd1c8bd648d58a73317c5c345d488d76305c55ea9f67
- SSDEEP 98304:kIOERqd/6hkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0E4jovLapID6bTIOSAB:SEYd/6ZJEul4szEonqtaovcID6bTfV
- TLSH T103C69E3275D58136D1664135CAA56FB4C3A47C3A4BF182CB76807AEE5A723C27D32B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory