General
- Target 2026-08-15_81dd8dc1f05bb5a04bda292f069a5bf0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_manuscrypt_rhadamanthys_smoke-loader_stop_vidar
- Size 21.1MB
- Sample260815-k8c4yahn7v
- SHA256 412def29a09c333e32b36bddead32861ecccf4048405f1b097003cf76dcb5819
- MD5 81dd8dc1f05bb5a04bda292f069a5bf0
- SHA1 531023765af88f2cace14d6941842c6781d5813c
- SHA512 5be9eab1d9c9157de2fe4caf7d51a43fa017c9ae55ed44d94336dafb7eb003287833e8389c81ad66bee430b3555739bc62bd961488762c8668a6ceebe4d02532
- SSDEEP 393216:ED5356MvydenVrjERBjbn2wBS1jEU8IBJP7m:EDy0nVrjEPbnNU1jzP7m
- TLSH T10127AF127AAC4231D86F6D3494A08275F5707C1B7F3AB68B2EC07E6D9D736C16939322
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-15_81dd8dc1f05bb5a04bda292f069a5bf0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-15_81dd8dc1f05bb5a04bda292f069a5bf0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_manuscrypt_rhadamanthys_smoke-loader_stop_vidar
- Size 21.1MB
- SHA256 412def29a09c333e32b36bddead32861ecccf4048405f1b097003cf76dcb5819
- MD5 81dd8dc1f05bb5a04bda292f069a5bf0
- SHA1 531023765af88f2cace14d6941842c6781d5813c
- SHA512 5be9eab1d9c9157de2fe4caf7d51a43fa017c9ae55ed44d94336dafb7eb003287833e8389c81ad66bee430b3555739bc62bd961488762c8668a6ceebe4d02532
- SSDEEP 393216:ED5356MvydenVrjERBjbn2wBS1jEU8IBJP7m:EDy0nVrjEPbnNU1jzP7m
- TLSH T10127AF127AAC4231D86F6D3494A08275F5707C1B7F3AB68B2EC07E6D9D736C16939322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory