General
- Target 2026-08-03_8a2cb9d5d937245ab5e2977663d33a59_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.5MB
- Sample260804-m2eejatycx
- SHA256 01d1ff97a8813c36f70f023d0f4406840ab8bb0ffedd0486d7cacdc03fea070c
- MD5 8a2cb9d5d937245ab5e2977663d33a59
- SHA1 b5ff8e4b283ce0a4ca4cf10e38bb1fee69372080
- SHA512 dd09357a6c4d4b0375fa070c7650e62426f74c329621e6baf252f2be5140ce4a1a79f36ee704d273a761c6357e7adec27a46dfa87d57dd53536a886d36181baf
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpmfCEe5jcAkSYqyEYD:A3kM8ljQpYqk
- TLSH T1EA756B22E6648175D07F8075CBA29656FA3338510BF08ACB53D4D67C2F227D19AFA723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-03_8a2cb9d5d937245ab5e2977663d33a59_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_8a2cb9d5d937245ab5e2977663d33a59_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_8a2cb9d5d937245ab5e2977663d33a59_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.5MB
- SHA256 01d1ff97a8813c36f70f023d0f4406840ab8bb0ffedd0486d7cacdc03fea070c
- MD5 8a2cb9d5d937245ab5e2977663d33a59
- SHA1 b5ff8e4b283ce0a4ca4cf10e38bb1fee69372080
- SHA512 dd09357a6c4d4b0375fa070c7650e62426f74c329621e6baf252f2be5140ce4a1a79f36ee704d273a761c6357e7adec27a46dfa87d57dd53536a886d36181baf
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpmfCEe5jcAkSYqyEYD:A3kM8ljQpYqk
- TLSH T1EA756B22E6648175D07F8075CBA29656FA3338510BF08ACB53D4D67C2F227D19AFA723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory