General
- Target 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar_wannacry
- Size 4.3MB
- Sample260808-bmgessba44
- SHA256 d0979ded2933dbe71f79630bf16229becba595ee36d8fbec684fbc9549bdcb91
- MD5 683a0cdb7070602155aa9f1944ec5831
- SHA1 49b2522bff4195cfdcb78e88c82b35e49f53d340
- SHA512 56bbd45557ffa07806910dbcdb954d75628ee5b60e0c9fa3e2556593fd28f6bac63d45ab93f83a8782df2b0814fda4eae40aaeee6899354582875641b8cf9f09
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbiYpYq6T3S9tsgX8zEC8ULgCSA/Bkj0p:7fkZcX6zTIOSAX
- TLSH T1E7266D12B3F88637E0BA927EC0B1597DE771742B9B32C78F3104AA5D5D677828526323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar_wannacry
- Size 4.3MB
- SHA256 d0979ded2933dbe71f79630bf16229becba595ee36d8fbec684fbc9549bdcb91
- MD5 683a0cdb7070602155aa9f1944ec5831
- SHA1 49b2522bff4195cfdcb78e88c82b35e49f53d340
- SHA512 56bbd45557ffa07806910dbcdb954d75628ee5b60e0c9fa3e2556593fd28f6bac63d45ab93f83a8782df2b0814fda4eae40aaeee6899354582875641b8cf9f09
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbiYpYq6T3S9tsgX8zEC8ULgCSA/Bkj0p:7fkZcX6zTIOSAX
- TLSH T1E7266D12B3F88637E0BA927EC0B1597DE771742B9B32C78F3104AA5D5D677828526323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory