General
- Target 2026-08-20_51c0e644c8d9bc5fc2758956063f6a8f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_stealc_vidar_wannacry
- Size 10.4MB
- Sample260821-ann1laybma
- SHA256 43ba717400fa9a970be23a3de6735e7f9d0f2070b8eff090c3e482b12dc09736
- MD5 51c0e644c8d9bc5fc2758956063f6a8f
- SHA1 ad53673350a3aec0c557c264f8dfb77a11d02b41
- SHA512 cd50f46fa459a4daba4fff7d9979ff0f6639dc686e1528771ea190950a90b33f5c31cdaaabc0f198b5b038d1e30d5ae34abd2ad3f0c11715b0f0cb9072aa6a02
- SSDEEP 49152:kpEqJtb2I5RJ5T3S9tsgX87WNNx3K7U6qPC8BVs7PM3V3UKCOX6EF83m2jKHXyoH:kqiR3TIFIo6qzBPxNSslfwTIOSAs
- TLSH T151B6491132D88FA9D06FD479C96228B596237C5A8F329FCF28407E2D39767A14E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-20_51c0e644c8d9bc5fc2758956063f6a8f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_51c0e644c8d9bc5fc2758956063f6a8f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_51c0e644c8d9bc5fc2758956063f6a8f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_stealc_vidar_wannacry
- Size 10.4MB
- SHA256 43ba717400fa9a970be23a3de6735e7f9d0f2070b8eff090c3e482b12dc09736
- MD5 51c0e644c8d9bc5fc2758956063f6a8f
- SHA1 ad53673350a3aec0c557c264f8dfb77a11d02b41
- SHA512 cd50f46fa459a4daba4fff7d9979ff0f6639dc686e1528771ea190950a90b33f5c31cdaaabc0f198b5b038d1e30d5ae34abd2ad3f0c11715b0f0cb9072aa6a02
- SSDEEP 49152:kpEqJtb2I5RJ5T3S9tsgX87WNNx3K7U6qPC8BVs7PM3V3UKCOX6EF83m2jKHXyoH:kqiR3TIFIo6qzBPxNSslfwTIOSAs
- TLSH T151B6491132D88FA9D06FD479C96228B596237C5A8F329FCF28407E2D39767A14E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory