General
- Target 2026-08-04_43cea922bd13299a78bba215a0857435_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar_wannacry
- Size 2.5MB
- Sample260804-y89d2age54
- SHA256 913132f4824e3c1b6d622f9bb4d4651cafd606b12eb6013ae30ffe7a6ce13579
- MD5 43cea922bd13299a78bba215a0857435
- SHA1 5148f17d7adaedb2da2422b4cbaf59c1b59bf210
- SHA512 80731ea4751c3857b80e1473ec5a98f67bbb8b3a5925f34de7ee8286d064e6a1141da87ffd5593153ccbc441181cab5303c9d53ec30d149d68921d34b17c8168
- SSDEEP 49152:A3kMhT1LljFeW4SkZP4sz9MblI1DPji0Aj:A3kMfLtJfkZclI1bjo
- TLSH T124C55C16F6B88372D0B3C079C5D6AA9AFA72344657308ACB0345D72C2F277D19A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-04_43cea922bd13299a78bba215a0857435_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_43cea922bd13299a78bba215a0857435_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_43cea922bd13299a78bba215a0857435_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar_wannacry
- Size 2.5MB
- SHA256 913132f4824e3c1b6d622f9bb4d4651cafd606b12eb6013ae30ffe7a6ce13579
- MD5 43cea922bd13299a78bba215a0857435
- SHA1 5148f17d7adaedb2da2422b4cbaf59c1b59bf210
- SHA512 80731ea4751c3857b80e1473ec5a98f67bbb8b3a5925f34de7ee8286d064e6a1141da87ffd5593153ccbc441181cab5303c9d53ec30d149d68921d34b17c8168
- SSDEEP 49152:A3kMhT1LljFeW4SkZP4sz9MblI1DPji0Aj:A3kMfLtJfkZclI1bjo
- TLSH T124C55C16F6B88372D0B3C079C5D6AA9AFA72344657308ACB0345D72C2F277D19A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory