General
- Target 2026-08-06_59ebcc2485b27f2e9627dfe60dce785d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 2.0MB
- Sample260806-1rlyhsvsbz
- SHA256 7b8c8d34d112a3bb15913673a5a43c12e3a801d8c2f9c9b6342a6a13ba83495d
- MD5 59ebcc2485b27f2e9627dfe60dce785d
- SHA1 10b1199f8f49ffadfcb5305a7a496fa5792fe24e
- SHA512 cb8da77e8296f5c5719134db03571b81ce405fecb36aeb0a0dd6de4c150fb92ba91a5d1f0bdb1caf4afe3703187a3ec2e93f823bdf3af867f164e7d418432624
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813SYTqMi8CtBd2QHCHmTBW5X0Le5ji0hmxNw:A3kM8ljMqJtb2IQPji0Aj
- TLSH T164A55C26F6748371D077C0B9C5E2A75AEA3134414B308ACB5399D76C2F277D29A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-06_59ebcc2485b27f2e9627dfe60dce785d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_59ebcc2485b27f2e9627dfe60dce785d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260710-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-06_59ebcc2485b27f2e9627dfe60dce785d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 2.0MB
- SHA256 7b8c8d34d112a3bb15913673a5a43c12e3a801d8c2f9c9b6342a6a13ba83495d
- MD5 59ebcc2485b27f2e9627dfe60dce785d
- SHA1 10b1199f8f49ffadfcb5305a7a496fa5792fe24e
- SHA512 cb8da77e8296f5c5719134db03571b81ce405fecb36aeb0a0dd6de4c150fb92ba91a5d1f0bdb1caf4afe3703187a3ec2e93f823bdf3af867f164e7d418432624
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHa813SYTqMi8CtBd2QHCHmTBW5X0Le5ji0hmxNw:A3kM8ljMqJtb2IQPji0Aj
- TLSH T164A55C26F6748371D077C0B9C5E2A75AEA3134414B308ACB5399D76C2F277D29A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory