General
- Target 2026-08-04_49b5bc97cbd267b872a84a8b039d3fed_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar_wannacry
- Size 9.7MB
- Sample260804-21wprafn3t
- SHA256 a209cc56e9ce6a69232d01fcf2b455874a16378589f6474b57600f80ecfade51
- MD5 49b5bc97cbd267b872a84a8b039d3fed
- SHA1 e068ef6ed62a0a5d0087eaef25c33967504b8c11
- SHA512 788488b6f560eabb8475c2ac116d6e91aeb571f21ab7e3cc0f21e9c7bb228494db70251e74287d7e8a58e1eeae1bab12545cd02fc986045ea56978ffd1ada53b
- SSDEEP 98304:lhpBv4Yan8Oyk+Xws+wE9XD8VBDdATIOSAxjoOTIOSAiDpjo1:Tpdyn8OyJgV9z8bdATfBoOTfGpo1
- TLSH T131A69E1273E44637E0BA527FC0B10A7997B5743B9B32C38F7544A99E5DA37828927323
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-04_49b5bc97cbd267b872a84a8b039d3fed_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_49b5bc97cbd267b872a84a8b039d3fed_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_icedid_rhadamanthys_smoke-loader_vidar_wannacry
- Size 9.7MB
- SHA256 a209cc56e9ce6a69232d01fcf2b455874a16378589f6474b57600f80ecfade51
- MD5 49b5bc97cbd267b872a84a8b039d3fed
- SHA1 e068ef6ed62a0a5d0087eaef25c33967504b8c11
- SHA512 788488b6f560eabb8475c2ac116d6e91aeb571f21ab7e3cc0f21e9c7bb228494db70251e74287d7e8a58e1eeae1bab12545cd02fc986045ea56978ffd1ada53b
- SSDEEP 98304:lhpBv4Yan8Oyk+Xws+wE9XD8VBDdATIOSAxjoOTIOSAiDpjo1:Tpdyn8OyJgV9z8bdATfBoOTfGpo1
- TLSH T131A69E1273E44637E0BA527FC0B10A7997B5743B9B32C38F7544A99E5DA37828927323
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Drops file in System32 directory