General
- Target 2026-08-21_f36e2fd49b65ca0e4810a10ff17f25cf_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 2.5MB
- Sample260821-pmx97sel8y
- SHA256 7280b86f9d6f6122e443b76b14afbe5e59fbc02d930af3f1384c913a39533f26
- MD5 f36e2fd49b65ca0e4810a10ff17f25cf
- SHA1 2700803d674aae37c1186ab9d1f546c3eca8609f
- SHA512 074bf03307adf92b077af16e092db3041b291e4a693b2e348f2982e545aa83bb29013e00daa62a240a90c962394d3c0cbcdb9addc7130af3148091003f51506c
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpm6v+aDirNZe0p4Ek4niOkl/A04szE87JKTvmlDK:A3kM8ljCiDeW4SkZP4sz9MbE56rX
- TLSH T1D1C53952BB798F72F06F8074C4929669A5333D090FE24AC7124EBF192F362C556F532A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-21_f36e2fd49b65ca0e4810a10ff17f25cf_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_f36e2fd49b65ca0e4810a10ff17f25cf_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260710-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-21_f36e2fd49b65ca0e4810a10ff17f25cf_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 2.5MB
- SHA256 7280b86f9d6f6122e443b76b14afbe5e59fbc02d930af3f1384c913a39533f26
- MD5 f36e2fd49b65ca0e4810a10ff17f25cf
- SHA1 2700803d674aae37c1186ab9d1f546c3eca8609f
- SHA512 074bf03307adf92b077af16e092db3041b291e4a693b2e348f2982e545aa83bb29013e00daa62a240a90c962394d3c0cbcdb9addc7130af3148091003f51506c
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpm6v+aDirNZe0p4Ek4niOkl/A04szE87JKTvmlDK:A3kM8ljCiDeW4SkZP4sz9MbE56rX
- TLSH T1D1C53952BB798F72F06F8074C4929669A5333D090FE24AC7124EBF192F362C556F532A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory