General
- Target 2026-08-09_3e66e782d0b4742489d8480a2abba2ed_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 960KB
- Sample260809-zt9a6ace42
- SHA256 460e1431186241af0787870df4df3648c124dde1fdf06a4d73793527b9de444d
- MD5 3e66e782d0b4742489d8480a2abba2ed
- SHA1 299d1d02a3f70f818cc7b775957ce3c6f417885c
- SHA512 e2a637ce0c4f75c453b5acde047b9498a96c4495d242ce34c614c9ff8bec51654014ac78cd2fb297a75e968a98d46c00ccc43bb703a640d31e08a6e6135bf278
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6EaoL0qp:A3mnXoZjzyaEFoHaewsAjYaEg6EaoLTp
- TLSH T1AA25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-09_3e66e782d0b4742489d8480a2abba2ed_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_3e66e782d0b4742489d8480a2abba2ed_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_3e66e782d0b4742489d8480a2abba2ed_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 960KB
- SHA256 460e1431186241af0787870df4df3648c124dde1fdf06a4d73793527b9de444d
- MD5 3e66e782d0b4742489d8480a2abba2ed
- SHA1 299d1d02a3f70f818cc7b775957ce3c6f417885c
- SHA512 e2a637ce0c4f75c453b5acde047b9498a96c4495d242ce34c614c9ff8bec51654014ac78cd2fb297a75e968a98d46c00ccc43bb703a640d31e08a6e6135bf278
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEg6EaoL0qp:A3mnXoZjzyaEFoHaewsAjYaEg6EaoLTp
- TLSH T1AA25B023EB7090B5D27B49705BB58713E7397C210B605ACBE3A886591F317C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory