General
- Target 2026-08-07_6296bf743d7a38fc4409bbf8abcf0b35_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 2.0MB
- Sample260807-nsd8vathpd
- SHA256 909ca8729a2f15bbb38d3e13725c7f84fb94ef16bd4cc4419cf4fd8ea76ba2ea
- MD5 6296bf743d7a38fc4409bbf8abcf0b35
- SHA1 d2f75ac14aa4fdcc7552a02d2ef839c9fdaac566
- SHA512 88efb4090a99269f89cac3d9246baf6ac2537e591ed212b724bbcd5128264f5a661f85d019c6c358b385268eedeebdd1226a017d7776c2cf996e10f494b3cb2a
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpmEZavpMYTqMi8CtBd2QHCHmTBW5X0Le5ji0hmxe:A3kM8ljLqJtb2IQPji0Aj
- TLSH T171A55C26F6748371D077C0B9C5E2A75AEA3134424B308ACB5399D76C2F277D29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-07_6296bf743d7a38fc4409bbf8abcf0b35_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_6296bf743d7a38fc4409bbf8abcf0b35_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260710-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-07_6296bf743d7a38fc4409bbf8abcf0b35_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 2.0MB
- SHA256 909ca8729a2f15bbb38d3e13725c7f84fb94ef16bd4cc4419cf4fd8ea76ba2ea
- MD5 6296bf743d7a38fc4409bbf8abcf0b35
- SHA1 d2f75ac14aa4fdcc7552a02d2ef839c9fdaac566
- SHA512 88efb4090a99269f89cac3d9246baf6ac2537e591ed212b724bbcd5128264f5a661f85d019c6c358b385268eedeebdd1226a017d7776c2cf996e10f494b3cb2a
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpmEZavpMYTqMi8CtBd2QHCHmTBW5X0Le5ji0hmxe:A3kM8ljLqJtb2IQPji0Aj
- TLSH T171A55C26F6748371D077C0B9C5E2A75AEA3134424B308ACB5399D76C2F277D29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory