General
- Target 2026-08-10_97fa886ec082c311ed4b4ed10bd0c136_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
- Size 2.3MB
- Sample260810-yrehbsssfv
- SHA256 325660464010f3744bcb1b3d3a1f0f2d6a76b63063bd0348d6de2c0f45361de3
- MD5 97fa886ec082c311ed4b4ed10bd0c136
- SHA1 a06d0eb0cd7604028cd0cc5578b1f66cbd45652d
- SHA512 268f0d16905a48dbd81e90ae7b27a06e26f697b66798214765accdfbf851593a2ae8ff95d00c9451d950e303a9eec99f5e07f3364d97672a655a6b43845396ac
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TLavdczWj8PSeWygmNWZcb1pEKdUnHBt9XYTqW:A3kM8ljouygmUSbHDUn8qJtb2I
- TLSH T1BBB55B21F7B881B5E0778574C9B29666FA7278520B3086CF5394C65E1F33AC19E3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-10_97fa886ec082c311ed4b4ed10bd0c136_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_97fa886ec082c311ed4b4ed10bd0c136_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_97fa886ec082c311ed4b4ed10bd0c136_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
- Size 2.3MB
- SHA256 325660464010f3744bcb1b3d3a1f0f2d6a76b63063bd0348d6de2c0f45361de3
- MD5 97fa886ec082c311ed4b4ed10bd0c136
- SHA1 a06d0eb0cd7604028cd0cc5578b1f66cbd45652d
- SHA512 268f0d16905a48dbd81e90ae7b27a06e26f697b66798214765accdfbf851593a2ae8ff95d00c9451d950e303a9eec99f5e07f3364d97672a655a6b43845396ac
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TLavdczWj8PSeWygmNWZcb1pEKdUnHBt9XYTqW:A3kM8ljouygmUSbHDUn8qJtb2I
- TLSH T1BBB55B21F7B881B5E0778574C9B29666FA7278520B3086CF5394C65E1F33AC19E3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory