General
- Target 2026-08-06_08d4b5c547ad4ee8e21353c20a956ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 2.8MB
- Sample260806-tdrhhsverf
- SHA256 4a7524041e792d8e6ce0924a10a39c7bfc3a13d9a5d20f1f37e08442f5c686b3
- MD5 08d4b5c547ad4ee8e21353c20a956ad4
- SHA1 3aacfb02764b4cb4914036771ba236bd6b038044
- SHA512 c42d3896246afeb68a158e4a960a1b2719abca7fa57836d25a3cf6f935c6a55d34fceca8975a6d94774e15c9d21e835932fa694042dc0f8886980aa39066e480
- SSDEEP 49152:A3kMFljz56rO1lkWu0y2eW4SkZP4sz9Mb6Pji0Aj:A3kMArO1lkNufkZcQjo
- TLSH T19AD54B12F6B88732E0B7C175C9E2A65AF9323C515F3086CB43549B6C2E27AD18A35737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-06_08d4b5c547ad4ee8e21353c20a956ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_08d4b5c547ad4ee8e21353c20a956ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-06_08d4b5c547ad4ee8e21353c20a956ad4_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 2.8MB
- SHA256 4a7524041e792d8e6ce0924a10a39c7bfc3a13d9a5d20f1f37e08442f5c686b3
- MD5 08d4b5c547ad4ee8e21353c20a956ad4
- SHA1 3aacfb02764b4cb4914036771ba236bd6b038044
- SHA512 c42d3896246afeb68a158e4a960a1b2719abca7fa57836d25a3cf6f935c6a55d34fceca8975a6d94774e15c9d21e835932fa694042dc0f8886980aa39066e480
- SSDEEP 49152:A3kMFljz56rO1lkWu0y2eW4SkZP4sz9Mb6Pji0Aj:A3kMArO1lkNufkZcQjo
- TLSH T19AD54B12F6B88732E0B7C175C9E2A65AF9323C515F3086CB43549B6C2E27AD18A35737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory