General
- Target 2026-08-12_c79e1e8d28ac03062d9184db9dc5fdf9_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar_wannacry
- Size 7.4MB
- Sample260812-1tstvaeq51
- SHA256 249f7cc5f68ca2707322708a498723a6c0c194d9a907910559e2dbecf8948ccf
- MD5 c79e1e8d28ac03062d9184db9dc5fdf9
- SHA1 14d1b833d4fdb31538a549675c5d3f70a4c25da5
- SHA512 f32cb40b570b24341a2d97bbd4dc8c54c80c559009cde97cd4c6de332b2858bdd763c447629fcfc56ede5fbd0c0c2c30969c840d1bd93068839f5b5d9f41633f
- SSDEEP 49152:PabH/dPIyNabH/HJVBXdcWabH/3IyNabH/HJVBXdcT4qiw3PASW9mMtJT3S9tsgj:iIyatduIyatdtgPALJTIIzLapIg
- TLSH T18B766C2231D1446AF119AE37CB2A7734A6A03C7A4FF1C28FF508769D1A756F17A36306
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-12_c79e1e8d28ac03062d9184db9dc5fdf9_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-12_c79e1e8d28ac03062d9184db9dc5fdf9_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar_wannacry
- Size 7.4MB
- SHA256 249f7cc5f68ca2707322708a498723a6c0c194d9a907910559e2dbecf8948ccf
- MD5 c79e1e8d28ac03062d9184db9dc5fdf9
- SHA1 14d1b833d4fdb31538a549675c5d3f70a4c25da5
- SHA512 f32cb40b570b24341a2d97bbd4dc8c54c80c559009cde97cd4c6de332b2858bdd763c447629fcfc56ede5fbd0c0c2c30969c840d1bd93068839f5b5d9f41633f
- SSDEEP 49152:PabH/dPIyNabH/HJVBXdcWabH/3IyNabH/HJVBXdcT4qiw3PASW9mMtJT3S9tsgj:iIyatduIyatdtgPALJTIIzLapIg
- TLSH T18B766C2231D1446AF119AE37CB2A7734A6A03C7A4FF1C28FF508769D1A756F17A36306
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Executes dropped EXE
-
Drops file in System32 directory