General
- Target 2026-08-10_ca54b4fcb464c428b00b00fd16dc503a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry
- Size 1.3MB
- Sample260810-gkvsasscme
- SHA256 138fc45784afa25d3d1490af95803fd62571acc22998055b7572806c0608da31
- MD5 ca54b4fcb464c428b00b00fd16dc503a
- SHA1 6c6147442ee53c68c77b24058838160277f4560d
- SHA512 e0790ef5c4912f2f3713cb57dbec9c793fb7dced851fb60b105d8aa38b83556501455591d2c1a23816965593476d6ba75c07be619b7d9cd661b33d340be09a24
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCa2zy7/az1owkWu0ya:A3kMhT1Lljsv1lkWu0ya
- TLSH T165656B12A3F514B8F5B386349DB59616EB76BC721B30C19F13A4065A1F33B809E39B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-10_ca54b4fcb464c428b00b00fd16dc503a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_ca54b4fcb464c428b00b00fd16dc503a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_ca54b4fcb464c428b00b00fd16dc503a_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry
- Size 1.3MB
- SHA256 138fc45784afa25d3d1490af95803fd62571acc22998055b7572806c0608da31
- MD5 ca54b4fcb464c428b00b00fd16dc503a
- SHA1 6c6147442ee53c68c77b24058838160277f4560d
- SHA512 e0790ef5c4912f2f3713cb57dbec9c793fb7dced851fb60b105d8aa38b83556501455591d2c1a23816965593476d6ba75c07be619b7d9cd661b33d340be09a24
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCa2zy7/az1owkWu0ya:A3kMhT1Lljsv1lkWu0ya
- TLSH T165656B12A3F514B8F5B386349DB59616EB76BC721B30C19F13A4065A1F33B809E39B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory