General
- Target 2026-08-09_90c741b1dc6c9be8f497cfff3f75ad6f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 2.7MB
- Sample260809-cjfvjassh1
- SHA256 f42371049b0a973a24a7739bca0242d8df5cf1561053568da71dc617f3d213cf
- MD5 90c741b1dc6c9be8f497cfff3f75ad6f
- SHA1 00c1ae84704be61080523788fda006a150bd7d0b
- SHA512 788d838dfd9731490cdc77d17ae734fbb386a9635833b8922e6c6fda736ef5f19448b54670071fda2d2ab0b0b4162ffa268e7a20faa62b132cb965fa0a1768e1
- SSDEEP 49152:A3kM8ljJeW4SkZP4sz9Mb5eW4SkZP4sz9Mb:A3kMYfkZcNfkZc
- TLSH T1A6D52916F6788323D0BBC0B9C6D6AA59FA3334454B708ACB0285D73C2F276D19676736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-09_90c741b1dc6c9be8f497cfff3f75ad6f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_90c741b1dc6c9be8f497cfff3f75ad6f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_90c741b1dc6c9be8f497cfff3f75ad6f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 2.7MB
- SHA256 f42371049b0a973a24a7739bca0242d8df5cf1561053568da71dc617f3d213cf
- MD5 90c741b1dc6c9be8f497cfff3f75ad6f
- SHA1 00c1ae84704be61080523788fda006a150bd7d0b
- SHA512 788d838dfd9731490cdc77d17ae734fbb386a9635833b8922e6c6fda736ef5f19448b54670071fda2d2ab0b0b4162ffa268e7a20faa62b132cb965fa0a1768e1
- SSDEEP 49152:A3kM8ljJeW4SkZP4sz9Mb5eW4SkZP4sz9Mb:A3kMYfkZcNfkZc
- TLSH T1A6D52916F6788323D0BBC0B9C6D6AA59FA3334454B708ACB0285D73C2F276D19676736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory