General
- Target 2026-08-07_1aeea8f0971bdb1761e82ec0fa86af18_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar
- Size 4.9MB
- Sample260807-v7465sttg1
- SHA256 e39a38aad8d0cc5e94a3104bd8c7ea6c8ff819c391a024e09da4e6100d7e0151
- MD5 1aeea8f0971bdb1761e82ec0fa86af18
- SHA1 5cade26c3fc4acd2b818c013aafb90a77c9580b0
- SHA512 6f6a6e0794d7cd060ff527c5ec32b2275fcd0e33fb16d165462849ab80c97be0af6c6ab2b9ae4b58d605057197d88ffa08a2ddc411d9c9f95a8e7a3e43934932
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbiYpYq6T3S9tsgX8zEC8ULgCSA/Bkj00qJtb2I7:7fkZcX6zTIOSA6K
- TLSH T1F2365C16B2F88737E0BA927EC0B15A6DE771342A9B32C6CF3104A65D5D677828536333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-07_1aeea8f0971bdb1761e82ec0fa86af18_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_1aeea8f0971bdb1761e82ec0fa86af18_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-07_1aeea8f0971bdb1761e82ec0fa86af18_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar
- Size 4.9MB
- SHA256 e39a38aad8d0cc5e94a3104bd8c7ea6c8ff819c391a024e09da4e6100d7e0151
- MD5 1aeea8f0971bdb1761e82ec0fa86af18
- SHA1 5cade26c3fc4acd2b818c013aafb90a77c9580b0
- SHA512 6f6a6e0794d7cd060ff527c5ec32b2275fcd0e33fb16d165462849ab80c97be0af6c6ab2b9ae4b58d605057197d88ffa08a2ddc411d9c9f95a8e7a3e43934932
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbiYpYq6T3S9tsgX8zEC8ULgCSA/Bkj00qJtb2I7:7fkZcX6zTIOSA6K
- TLSH T1F2365C16B2F88737E0BA927EC0B15A6DE771342A9B32C6CF3104A65D5D677828536333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory