General
- Target 2026-08-17_4b81a8335f9c964598efedd523307864_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_stealc_vidar_wannacry
- Size 29.8MB
- Sample260817-cq2qkshb25
- SHA256 319185c3a5c5c8b7a9d3619694ec2bb7189a6787f67b81c268426c0bedb7e9b5
- MD5 4b81a8335f9c964598efedd523307864
- SHA1 92b990192818a9c56649d8299150eb8edd1eeb97
- SHA512 02bba0bae757b8fb00e29de2adc4a695b61e1e35f9b488e40eae34eb6ed2cf52090ee13634c08696f61a8f8e41a9297529cf8fb11239afd7af8ab60f66136169
- SSDEEP 196608:JtcIkGn+oKLtcIkGn+oKXvyEYc/b3w8OGnotcIkGn+oKLtcIkG:I5G+ob5G+oKvyEYKbaGR5G+ob5G
- TLSH T119675A1676A440E5D1AAC134CF568632E3B27C194BF097EB5251B2DE2F33AD07E3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_4b81a8335f9c964598efedd523307864_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_4b81a8335f9c964598efedd523307864_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-17_4b81a8335f9c964598efedd523307864_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_stealc_vidar_wannacry
- Size 29.8MB
- SHA256 319185c3a5c5c8b7a9d3619694ec2bb7189a6787f67b81c268426c0bedb7e9b5
- MD5 4b81a8335f9c964598efedd523307864
- SHA1 92b990192818a9c56649d8299150eb8edd1eeb97
- SHA512 02bba0bae757b8fb00e29de2adc4a695b61e1e35f9b488e40eae34eb6ed2cf52090ee13634c08696f61a8f8e41a9297529cf8fb11239afd7af8ab60f66136169
- SSDEEP 196608:JtcIkGn+oKLtcIkGn+oKXvyEYc/b3w8OGnotcIkGn+oKLtcIkG:I5G+ob5G+oKvyEYKbaGR5G+ob5G
- TLSH T119675A1676A440E5D1AAC134CF568632E3B27C194BF097EB5251B2DE2F33AD07E3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry