General
- Target 2026-08-08_9dc9a4a9474937f3f753f90848a7fd1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.4MB
- Sample260808-nqwecawbrb
- SHA256 e399d19f2379639fc16d63235877c0bf0446fa6ebef7022a7e898b6509a97a2c
- MD5 9dc9a4a9474937f3f753f90848a7fd1b
- SHA1 88ef1936e0f7abaf92a0f647caefd895bee860f1
- SHA512 e42d4f00d7154d4b59fc9f1a803f83df6dd9673eb2ef046e74bf3fd525d3bd8bf13b5251edd6c072439832661bd67cc3137aa3ce7f9d80138db36647748ce109
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6EaWoTaMD5TvinrmVD5TvinrmgF:A3kM8ljI56ru56r9
- TLSH T14E658D12E6A48FA5D26F4170CE668612E6377C514F204BDF53A4BF693E327C0AA39713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-08_9dc9a4a9474937f3f753f90848a7fd1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_9dc9a4a9474937f3f753f90848a7fd1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_9dc9a4a9474937f3f753f90848a7fd1b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.4MB
- SHA256 e399d19f2379639fc16d63235877c0bf0446fa6ebef7022a7e898b6509a97a2c
- MD5 9dc9a4a9474937f3f753f90848a7fd1b
- SHA1 88ef1936e0f7abaf92a0f647caefd895bee860f1
- SHA512 e42d4f00d7154d4b59fc9f1a803f83df6dd9673eb2ef046e74bf3fd525d3bd8bf13b5251edd6c072439832661bd67cc3137aa3ce7f9d80138db36647748ce109
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6EaWoTaMD5TvinrmVD5TvinrmgF:A3kM8ljI56ru56r9
- TLSH T14E658D12E6A48FA5D26F4170CE668612E6377C514F204BDF53A4BF693E327C0AA39713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory