General
- Target 2026-08-12_18b02108beb479f9d6ac4d33f76ac3df_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 957KB
- Sample260812-x4822adn3v
- SHA256 01f5f278c05c0c6610fbb3fdd117dce7263952be2f30172454a427f37281f3eb
- MD5 18b02108beb479f9d6ac4d33f76ac3df
- SHA1 970bf22a44fae0fbbd41c6878a582bd6fc966e55
- SHA512 f62c98535d01f44e411daaef50be99b90031dcb9308aac618b0cce966c5e9c0baf0991b89c0508c90a9916d830df1c7efd92fed77973a3f8876954cd31e597e5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHacVZlc:A3mnXoZjzyaEFoHaewsAjYaEpHaSlc
- TLSH T19725B023EB7090B5D27B45705BB58713E7797C210B605ACBE3A88A591F313C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-12_18b02108beb479f9d6ac4d33f76ac3df_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_18b02108beb479f9d6ac4d33f76ac3df_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawke.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-12_18b02108beb479f9d6ac4d33f76ac3df_amadey_cobalt-strike_conti_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 957KB
- SHA256 01f5f278c05c0c6610fbb3fdd117dce7263952be2f30172454a427f37281f3eb
- MD5 18b02108beb479f9d6ac4d33f76ac3df
- SHA1 970bf22a44fae0fbbd41c6878a582bd6fc966e55
- SHA512 f62c98535d01f44e411daaef50be99b90031dcb9308aac618b0cce966c5e9c0baf0991b89c0508c90a9916d830df1c7efd92fed77973a3f8876954cd31e597e5
- SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoCAwSfxL/2Dc3jDLLmt0LDQewsAjR2aEpHacVZlc:A3mnXoZjzyaEFoHaewsAjYaEpHaSlc
- TLSH T19725B023EB7090B5D27B45705BB58713E7797C210B605ACBE3A88A591F313C06F3AB66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory