General
- Target 2026-08-07_295033fa0a81897e785f8c22aae626af_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.5MB
- Sample260807-n39gqsxvb1
- SHA256 d5aef3bdcb6495733f453965e6213a56b33a38f894cb8958cf607fcb215cb58c
- MD5 295033fa0a81897e785f8c22aae626af
- SHA1 5a3b0d4abcba31d105e7c93b30be357d6015aef1
- SHA512 c54499ef250313006f68d986517f902df293019ffbf729641f36df7f52512d0e605d50f6ebf4400ccf9ed00706c7b689e9fe1e30faa6fe87e4c013c7322e2c6a
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpmEZavQRP0Le5ji0hmxNrM:A3kM8ljCPji0Aj
- TLSH T18E758D22FA748275D177C475CAE2975AEA7138510B308ACB9398C76C2F237D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-07_295033fa0a81897e785f8c22aae626af_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_295033fa0a81897e785f8c22aae626af_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-07_295033fa0a81897e785f8c22aae626af_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.5MB
- SHA256 d5aef3bdcb6495733f453965e6213a56b33a38f894cb8958cf607fcb215cb58c
- MD5 295033fa0a81897e785f8c22aae626af
- SHA1 5a3b0d4abcba31d105e7c93b30be357d6015aef1
- SHA512 c54499ef250313006f68d986517f902df293019ffbf729641f36df7f52512d0e605d50f6ebf4400ccf9ed00706c7b689e9fe1e30faa6fe87e4c013c7322e2c6a
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpmEZavQRP0Le5ji0hmxNrM:A3kM8ljCPji0Aj
- TLSH T18E758D22FA748275D177C475CAE2975AEA7138510B308ACB9398C76C2F237D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory