General
- Target 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry
- Size 5.7MB
- Sample260804-yzpy2adn6x
- SHA256 0941b1a1ce57ba361afdfbe952ed487446512cfb491a547f9b5246468a9ea369
- MD5 54b26343924f22e0d2942622fe3b6a5c
- SHA1 8ae40c52d731f02193ca94d51a1b2845ec332964
- SHA512 e381cf1a89984cfcd1ee3e30f71fc67feb1721e20ec0a9cfd8a9f4476c53110383e29807b7dc6da9190ee6b7b01b2133ce7fc350f00bdab2c84aa768e5ef0ee2
- SSDEEP 49152:kpEqJtb2I5RJ5T3S9tsgX8zEC8ULgCSA/Bkj0bgjI45TMwwapIgT+Pji0AjQS:kqiR3TIOSAzLapI1joES
- TLSH T141564B2272E44526D16A913ACF614A3997F13C3A8FF2C39B7104B6DD1E727C1BA26713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar_wannacry
- Size 5.7MB
- SHA256 0941b1a1ce57ba361afdfbe952ed487446512cfb491a547f9b5246468a9ea369
- MD5 54b26343924f22e0d2942622fe3b6a5c
- SHA1 8ae40c52d731f02193ca94d51a1b2845ec332964
- SHA512 e381cf1a89984cfcd1ee3e30f71fc67feb1721e20ec0a9cfd8a9f4476c53110383e29807b7dc6da9190ee6b7b01b2133ce7fc350f00bdab2c84aa768e5ef0ee2
- SSDEEP 49152:kpEqJtb2I5RJ5T3S9tsgX8zEC8ULgCSA/Bkj0bgjI45TMwwapIgT+Pji0AjQS:kqiR3TIOSAzLapI1joES
- TLSH T141564B2272E44526D16A913ACF614A3997F13C3A8FF2C39B7104B6DD1E727C1BA26713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory