General
- Target 2026-08-05_dfb5a50d6d23ba7b41d4e9906bb4b89b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.4MB
- Sample260805-mtm2pszvaw
- SHA256 844ef6bed35f53f8cbe913ef733009809653448b5d35a22715be511f3e9548a2
- MD5 dfb5a50d6d23ba7b41d4e9906bb4b89b
- SHA1 f5d7d550cdbb9a1243480e0a24b4dadf6eda0f85
- SHA512 02aaf945758635b4b51009200094b2f18c0244c2c03e894714b0146bb4608e395c4969b5b5a04a920fed49155090c19819916d31a4b8fcce62fccb7d733bddba
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHagCeYTqMi8CtBd2QHCHmTBW5:A3kM8ljjqJtb2I
- TLSH T14D657C22F6B48271D077C475CAE29B56EA3138514B308ACB5398D76D2F337D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-05_dfb5a50d6d23ba7b41d4e9906bb4b89b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_dfb5a50d6d23ba7b41d4e9906bb4b89b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-05_dfb5a50d6d23ba7b41d4e9906bb4b89b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.4MB
- SHA256 844ef6bed35f53f8cbe913ef733009809653448b5d35a22715be511f3e9548a2
- MD5 dfb5a50d6d23ba7b41d4e9906bb4b89b
- SHA1 f5d7d550cdbb9a1243480e0a24b4dadf6eda0f85
- SHA512 02aaf945758635b4b51009200094b2f18c0244c2c03e894714b0146bb4608e395c4969b5b5a04a920fed49155090c19819916d31a4b8fcce62fccb7d733bddba
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHagCeYTqMi8CtBd2QHCHmTBW5:A3kM8ljjqJtb2I
- TLSH T14D657C22F6B48271D077C475CAE29B56EA3138514B308ACB5398D76D2F337D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory