General
- Target 2026-08-09_bb9b9b5d931885ec3ada4a0544620a7d_amadey_cobalt-strike_elex_glassworm_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar
- Size 1.7MB
- Sample260809-wv22patbpd
- SHA256 d8e984eba9f356c996b1a2a8a6d15cb5475657a9a8d31f99d612d31863dab3ba
- MD5 bb9b9b5d931885ec3ada4a0544620a7d
- SHA1 48c5344015a564df37ec30c36d1a297c1b6c8db7
- SHA512 9196e28c795b22859c5109fe27b834a30e09e11686c91ba1c48115716183d31ab213310487ebb0097baf9c294b29c63e66de559ef7228d42e96474cf074c9304
- SSDEEP 24576:lC96H0J7ZC96H0J7t7WUtLpwbtLpwUUOlZ7q/cOD5TvinrmC:lvHg7ZvHg7RbtL2tLJUOlk0I56rX
- TLSH T173855C16FB688EF2D56F857886628651D6733C210F2187CB52649E2E3E337D09E35B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-09_bb9b9b5d931885ec3ada4a0544620a7d_amadey_cobalt-strike_elex_glassworm_hijackloader_redline.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_bb9b9b5d931885ec3ada4a0544620a7d_amadey_cobalt-strike_elex_glassworm_hijackloader_redline.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_bb9b9b5d931885ec3ada4a0544620a7d_amadey_cobalt-strike_elex_glassworm_hijackloader_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar
- Size 1.7MB
- SHA256 d8e984eba9f356c996b1a2a8a6d15cb5475657a9a8d31f99d612d31863dab3ba
- MD5 bb9b9b5d931885ec3ada4a0544620a7d
- SHA1 48c5344015a564df37ec30c36d1a297c1b6c8db7
- SHA512 9196e28c795b22859c5109fe27b834a30e09e11686c91ba1c48115716183d31ab213310487ebb0097baf9c294b29c63e66de559ef7228d42e96474cf074c9304
- SSDEEP 24576:lC96H0J7ZC96H0J7t7WUtLpwbtLpwUUOlZ7q/cOD5TvinrmC:lvHg7ZvHg7RbtL2tLJUOlk0I56rX
- TLSH T173855C16FB688EF2D56F857886628651D6733C210F2187CB52649E2E3E337D09E35B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory