General
- Target 2026-08-04_0f6e121bfe05e07614b8987d0b4ad8d8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 975KB
- Sample260804-z4rtvszhne
- SHA256 48a45ee40712166bb99131303a0087944424d48b632caf987fd14b20b6de40d1
- MD5 0f6e121bfe05e07614b8987d0b4ad8d8
- SHA1 23cbac9f93f039d636773a375ac84a06236bbf43
- SHA512 b26897cd7f1b1b20f491b9b56f22cbf251e68d662272861bf60e1eecfaca4f60f4f66d94a39950fdf6bbe0d7688c55adeb00e9635cacadccbdcea41e3eac9177
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNavFYf:A3kM8ljK
- TLSH T15925B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-04_0f6e121bfe05e07614b8987d0b4ad8d8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_0f6e121bfe05e07614b8987d0b4ad8d8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_0f6e121bfe05e07614b8987d0b4ad8d8_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 975KB
- SHA256 48a45ee40712166bb99131303a0087944424d48b632caf987fd14b20b6de40d1
- MD5 0f6e121bfe05e07614b8987d0b4ad8d8
- SHA1 23cbac9f93f039d636773a375ac84a06236bbf43
- SHA512 b26897cd7f1b1b20f491b9b56f22cbf251e68d662272861bf60e1eecfaca4f60f4f66d94a39950fdf6bbe0d7688c55adeb00e9635cacadccbdcea41e3eac9177
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNavFYf:A3kM8ljK
- TLSH T15925B023EB7090B5D27B49705BB58713EB397C210B605ACBE3688A591F317C06F3A766
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory