General
- Target 2026-08-16_70cb2a759541ec0e008191187c0e137f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar_wannacry
- Size 5.4MB
- Sample260816-mskvyswtbt
- SHA256 6c1a196fe871fe62e047a718e1db2f1129c9a2d42c905b0f67a5f37fe1eac048
- MD5 70cb2a759541ec0e008191187c0e137f
- SHA1 a8d22e1b934cff7827ba124252327178e364094a
- SHA512 dc779d5b12018dbda5ceb824346a5840ceb4d9128a1c9fa8648d1fc7ecba8f9f3814cd9f019df836293fc03a9e16ba7e3159fe741458a0b56a90ceaec35b3661
- SSDEEP 49152:A3k03kOTd9CHKyaVeW4SkZP4sz9MbL8tDZqrKU56rHqJtb2IEeW4SkZP4sz9MbEa:A3k03kgCq5fkZcLqrHFfkZcBrjP9
- TLSH T126460855F6B88762D07BC079C6969665FA733C410F308BCB0285EB2D2F376D1993A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-16_70cb2a759541ec0e008191187c0e137f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_70cb2a759541ec0e008191187c0e137f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-16_70cb2a759541ec0e008191187c0e137f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar_wannacry
- Size 5.4MB
- SHA256 6c1a196fe871fe62e047a718e1db2f1129c9a2d42c905b0f67a5f37fe1eac048
- MD5 70cb2a759541ec0e008191187c0e137f
- SHA1 a8d22e1b934cff7827ba124252327178e364094a
- SHA512 dc779d5b12018dbda5ceb824346a5840ceb4d9128a1c9fa8648d1fc7ecba8f9f3814cd9f019df836293fc03a9e16ba7e3159fe741458a0b56a90ceaec35b3661
- SSDEEP 49152:A3k03kOTd9CHKyaVeW4SkZP4sz9MbL8tDZqrKU56rHqJtb2IEeW4SkZP4sz9MbEa:A3k03kgCq5fkZcLqrHFfkZcBrjP9
- TLSH T126460855F6B88762D07BC079C6969665FA733C410F308BCB0285EB2D2F376D1993A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory