General
- Target 2026-08-08_a75d22cbd0a6229e6c9745c4f676172c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_vidar_wannacry
- Size 20.4MB
- Sample260808-v12sfa1gjd
- SHA256 6d42e7ca62ddbf2474f3fceaac5d8ac2f147c0678206212399667aa9ae8f91df
- MD5 a75d22cbd0a6229e6c9745c4f676172c
- SHA1 5c288f583fdfac9c4a4b72696d4d9e0947eec6f6
- SHA512 13a37d140236372b35c5ffe676277725eeb7fa24d33e10864123b80f63874d1eb1b3ce784961b6e1d8ec8415d975cd4dd3ace82a24faa3982ea06560009126b7
- SSDEEP 196608:LitTf/cIBoEFdYKmd0RoocIWdyeGZF6bUpMBF1p/kjRm4OWi2biEU8IBtzN:8M9sqLVuIbUwF1VERmj2biEU8IBJN
- TLSH T11E27AE22B2E404A9D06AD139CF528635D7B17C2A8BF1C3DB3154B6D92F736C17A3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-08_a75d22cbd0a6229e6c9745c4f676172c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_a75d22cbd0a6229e6c9745c4f676172c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_a75d22cbd0a6229e6c9745c4f676172c_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_vidar_wannacry
- Size 20.4MB
- SHA256 6d42e7ca62ddbf2474f3fceaac5d8ac2f147c0678206212399667aa9ae8f91df
- MD5 a75d22cbd0a6229e6c9745c4f676172c
- SHA1 5c288f583fdfac9c4a4b72696d4d9e0947eec6f6
- SHA512 13a37d140236372b35c5ffe676277725eeb7fa24d33e10864123b80f63874d1eb1b3ce784961b6e1d8ec8415d975cd4dd3ace82a24faa3982ea06560009126b7
- SSDEEP 196608:LitTf/cIBoEFdYKmd0RoocIWdyeGZF6bUpMBF1p/kjRm4OWi2biEU8IBtzN:8M9sqLVuIbUwF1VERmj2biEU8IBJN
- TLSH T11E27AE22B2E404A9D06AD139CF528635D7B17C2A8BF1C3DB3154B6D92F736C17A3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory