General
- Target 2026-08-10_75f21a21f09f45802f3f93e4565c07be_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 3.0MB
- Sample260810-kb3ckayzbw
- SHA256 0996b81a7a4d508653cafd37a4be56be8e5e4ee7852acab685c63f5d3f1be77e
- MD5 75f21a21f09f45802f3f93e4565c07be
- SHA1 e7040f145f01df122775267a3bb7bf4b4b1031fd
- SHA512 5b55e4361576c8ef4d5cec20647c6d649ff9d2ccdcdc9c3e879e467265c8b828a6c87a44371eed8ce9ca47405aacab9e2da035e9762943ea0eab805972f3439e
- SSDEEP 49152:A3kM8lj1eW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0Aj:A3kMqfkZcNfkZcRjo
- TLSH T182E51916F6788333D0B3C0B9C5D6AB9AFA3234455B308ACB4249D76C2E277D68636735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-10_75f21a21f09f45802f3f93e4565c07be_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_75f21a21f09f45802f3f93e4565c07be_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_75f21a21f09f45802f3f93e4565c07be_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 3.0MB
- SHA256 0996b81a7a4d508653cafd37a4be56be8e5e4ee7852acab685c63f5d3f1be77e
- MD5 75f21a21f09f45802f3f93e4565c07be
- SHA1 e7040f145f01df122775267a3bb7bf4b4b1031fd
- SHA512 5b55e4361576c8ef4d5cec20647c6d649ff9d2ccdcdc9c3e879e467265c8b828a6c87a44371eed8ce9ca47405aacab9e2da035e9762943ea0eab805972f3439e
- SSDEEP 49152:A3kM8lj1eW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0Aj:A3kMqfkZcNfkZcRjo
- TLSH T182E51916F6788333D0B3C0B9C5D6AB9AFA3234455B308ACB4249D76C2E277D68636735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory