General
- Target 2026-08-16_90b8dfc5896c2a8db6643a6ab040083d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.5MB
- Sample260816-q2exvadf72
- SHA256 19ae41a88ad936cf99fbe30bba85859feeffc7c92f5d0f302e39524c890967e0
- MD5 90b8dfc5896c2a8db6643a6ab040083d
- SHA1 0c5940a257107122b4cb8427307e3ca42fd50746
- SHA512 40fa2ba867acfe12d778f5fe8dde9ddd6bb2f97d3ec198496d415b6769067ab6a3e95b69d0edcc4f3195dd7603df1027be68294b300cab8c434721aa71eba988
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjJzy8BhYTqMi8CtBd2QHCHmTBW5M:A3kMPljJCqJtb2I
- TLSH T158757C22F6B48275D077C475CAE29B56FB3138514B308ACB5398876D2F237D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-16_90b8dfc5896c2a8db6643a6ab040083d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_90b8dfc5896c2a8db6643a6ab040083d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-16_90b8dfc5896c2a8db6643a6ab040083d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.5MB
- SHA256 19ae41a88ad936cf99fbe30bba85859feeffc7c92f5d0f302e39524c890967e0
- MD5 90b8dfc5896c2a8db6643a6ab040083d
- SHA1 0c5940a257107122b4cb8427307e3ca42fd50746
- SHA512 40fa2ba867acfe12d778f5fe8dde9ddd6bb2f97d3ec198496d415b6769067ab6a3e95b69d0edcc4f3195dd7603df1027be68294b300cab8c434721aa71eba988
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjJzy8BhYTqMi8CtBd2QHCHmTBW5M:A3kMPljJCqJtb2I
- TLSH T158757C22F6B48275D077C475CAE29B56FB3138514B308ACB5398876D2F237D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory