General
- Target 2026-08-03_e641147f3fef4a2fced4bf20f6d91e4f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 11.9MB
- Sample260804-k6tznsbq6v
- SHA256 c25192aa324986191518f6f3d1f3e1619583392784775ee36b918662e0f62c60
- MD5 e641147f3fef4a2fced4bf20f6d91e4f
- SHA1 a268837a731ad9263ab2c67553bd1dc8b0142232
- SHA512 ab2069184d0347fe54f4dca81d29419990698fc627a8bb76e5d25f873a25366d977ba2a2850d1b87939240e2ac4f20a6b07ce2e23dbca3aed29467842683e427
- SSDEEP 196608:KWSK9qnhjKmd0ERUZ/K0t6rXld8ofbTfl:KTMqncq5aZ/K0t6r1h/N
- TLSH T15AC66A12B2EA4266D87AD138CF78857996703C594BF1C2DB3140B69DA9336D47A3F323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-03_e641147f3fef4a2fced4bf20f6d91e4f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_e641147f3fef4a2fced4bf20f6d91e4f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_e641147f3fef4a2fced4bf20f6d91e4f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 11.9MB
- SHA256 c25192aa324986191518f6f3d1f3e1619583392784775ee36b918662e0f62c60
- MD5 e641147f3fef4a2fced4bf20f6d91e4f
- SHA1 a268837a731ad9263ab2c67553bd1dc8b0142232
- SHA512 ab2069184d0347fe54f4dca81d29419990698fc627a8bb76e5d25f873a25366d977ba2a2850d1b87939240e2ac4f20a6b07ce2e23dbca3aed29467842683e427
- SSDEEP 196608:KWSK9qnhjKmd0ERUZ/K0t6rXld8ofbTfl:KTMqncq5aZ/K0t6r1h/N
- TLSH T15AC66A12B2EA4266D87AD138CF78857996703C594BF1C2DB3140B69DA9336D47A3F323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory