General
- Target 2026-08-12_1f009a0dcdcb95df96c38d31f257a94f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 3.1MB
- Sample260812-nfry6scc55
- SHA256 b5b81bb4264a1b2d61f9ee18fa8b7d680b6bc6321712d7c8764f0073d162a076
- MD5 1f009a0dcdcb95df96c38d31f257a94f
- SHA1 438cfea56f7e8708e688328459483c74d9192354
- SHA512 c9f35bd3a28a7ad1a0fb332644d8b2f59b6657a4ec4515cae7ad593300fbaf9d34df08421b5b4ea1afdd03689eeb29427a29270e27e12f385458c7b013407e84
- SSDEEP 49152:A3kMPljFeW4SkZP4sz9MbkqJtb2IdqJtb2Ij56r0:A3kMjfkZckcJr0
- TLSH T113E53B25F6788732D077C0B9C5D2AA9AFA3238415F308ACB1345DB6C2E277D19636736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-12_1f009a0dcdcb95df96c38d31f257a94f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_1f009a0dcdcb95df96c38d31f257a94f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-12_1f009a0dcdcb95df96c38d31f257a94f_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 3.1MB
- SHA256 b5b81bb4264a1b2d61f9ee18fa8b7d680b6bc6321712d7c8764f0073d162a076
- MD5 1f009a0dcdcb95df96c38d31f257a94f
- SHA1 438cfea56f7e8708e688328459483c74d9192354
- SHA512 c9f35bd3a28a7ad1a0fb332644d8b2f59b6657a4ec4515cae7ad593300fbaf9d34df08421b5b4ea1afdd03689eeb29427a29270e27e12f385458c7b013407e84
- SSDEEP 49152:A3kMPljFeW4SkZP4sz9MbkqJtb2IdqJtb2Ij56r0:A3kMjfkZckcJr0
- TLSH T113E53B25F6788732D077C0B9C5D2AA9AFA3238415F308ACB1345DB6C2E277D19636736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory