General
- Target 2026-08-17_6386acf5fb14a1d0a584fc56373ddbe1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.4MB
- Sample260817-s95vcat1hs
- SHA256 eecad0592e376dd0ac20af165392957b69a236f3d250e058fe790dc852d87316
- MD5 6386acf5fb14a1d0a584fc56373ddbe1
- SHA1 2638392a896931cb7eece2833ffad7f8ee16054d
- SHA512 22b9512aa6494bd2b7a7dc4838d02c1d8bed3d8bf77a3aec1996e5b689984c7a01114eab9db336cd75484be6f6da48575ea963ab923716b2765dc4187c449492
- SSDEEP 24576:A3mnXoZjzyaEFoeo+aewsAjVGCJ0Le5ji0hmxNrM:A3kMFlj5Pji0Aj
- TLSH T137658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-17_6386acf5fb14a1d0a584fc56373ddbe1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_6386acf5fb14a1d0a584fc56373ddbe1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-17_6386acf5fb14a1d0a584fc56373ddbe1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.4MB
- SHA256 eecad0592e376dd0ac20af165392957b69a236f3d250e058fe790dc852d87316
- MD5 6386acf5fb14a1d0a584fc56373ddbe1
- SHA1 2638392a896931cb7eece2833ffad7f8ee16054d
- SHA512 22b9512aa6494bd2b7a7dc4838d02c1d8bed3d8bf77a3aec1996e5b689984c7a01114eab9db336cd75484be6f6da48575ea963ab923716b2765dc4187c449492
- SSDEEP 24576:A3mnXoZjzyaEFoeo+aewsAjVGCJ0Le5ji0hmxNrM:A3kMFlj5Pji0Aj
- TLSH T137658E22FA748275D077C4B5CAE2975AEA7134510B308ACB9398C76C2F277D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory