General
- Target 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar_wannacry
- Size 16.4MB
- Sample260820-vp44esef98
- SHA256 ca24f778bff2cc313b18927614d3ffdbad43c47c7ee350a5d71c81cca992a128
- MD5 c31d1f6acec5ae5ad0c524c9e54e113e
- SHA1 60586e79254065cce31ecde8fa606f36f046730e
- SHA512 ea3cecd23f6bb4a8cf393673a0cc35cf01ecdf19ee3d74d5a4284ce71abc79dd5d1aeb6b1a504fb4b28cdc06e87df791235655664584cab8c237103c565d61ad
- SSDEEP 196608:8pAnjOyAdOrNTfNogKmd0JoUdGok1mTfhTfQ:OAntqnqHQrdY
- TLSH T12B077C1273E44627E0AA927EC4714A3997717C3A9B72C2CF3544B99E19737C29A37323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackload.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_c31d1f6acec5ae5ad0c524c9e54e113e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar_wannacry
- Size 16.4MB
- SHA256 ca24f778bff2cc313b18927614d3ffdbad43c47c7ee350a5d71c81cca992a128
- MD5 c31d1f6acec5ae5ad0c524c9e54e113e
- SHA1 60586e79254065cce31ecde8fa606f36f046730e
- SHA512 ea3cecd23f6bb4a8cf393673a0cc35cf01ecdf19ee3d74d5a4284ce71abc79dd5d1aeb6b1a504fb4b28cdc06e87df791235655664584cab8c237103c565d61ad
- SSDEEP 196608:8pAnjOyAdOrNTfNogKmd0JoUdGok1mTfhTfQ:OAntqnqHQrdY
- TLSH T12B077C1273E44627E0AA927EC4714A3997717C3A9B72C2CF3544B99E19737C29A37323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
UPX dump on OEP (original entry point)
-
Drops file in System32 directory