General
- Target 2026-08-03_47051f013265c5b85aae6dc2e169af62_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_manuscrypt_njrat_rhadamanthys_smoke-loader_stop_vidar_wannacry
- Size 5.4MB
- Sample260803-wya3dadf65
- SHA256 7a0bcce7b741df461405a032c2ced59b07c531363146effa6c3a1cf1a5db031d
- MD5 47051f013265c5b85aae6dc2e169af62
- SHA1 6a1c8b73423988200dd6d186761051af3c496289
- SHA512 d887321c6da8a813ddc0ebbb1f2efe51338c1f67c581dffde7c8ab4a5fb90c3e30018246ed30864266aa238d39d55ea408015a4103603b1890baf6b5f7f6c721
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWe:smAE969/9h
- TLSH T1D5465A11F7A48672D0B78575C8A7A75AEA327C411F3087CF1384B66D2E337D1AA36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-03_47051f013265c5b85aae6dc2e169af62_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_47051f013265c5b85aae6dc2e169af62_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_47051f013265c5b85aae6dc2e169af62_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_manuscrypt_njrat_rhadamanthys_smoke-loader_stop_vidar_wannacry
- Size 5.4MB
- SHA256 7a0bcce7b741df461405a032c2ced59b07c531363146effa6c3a1cf1a5db031d
- MD5 47051f013265c5b85aae6dc2e169af62
- SHA1 6a1c8b73423988200dd6d186761051af3c496289
- SHA512 d887321c6da8a813ddc0ebbb1f2efe51338c1f67c581dffde7c8ab4a5fb90c3e30018246ed30864266aa238d39d55ea408015a4103603b1890baf6b5f7f6c721
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWe:smAE969/9h
- TLSH T1D5465A11F7A48672D0B78575C8A7A75AEA327C411F3087CF1384B66D2E337D1AA36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory