General
- Target 2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-stealer_mespinoza_njrat_poet-rat_remcos_smoke-loader
- Size 3.9MB
- Sample260823-qhrgjaxbme
- SHA256 c567f2b67d485fe319a9599b6a7a80d9d24e2646dc8bf6457b4e2b839a0d79a3
- MD5 0665dea4dcaa7eab82b14b46feb7387e
- SHA1 ca53dc5b050ee4b5775ed41ccb85bbc893852b25
- SHA512 dbb8f8b7691663c46ae081aa83268a1b776b36ddab83b298e60ef317a8dc32340c9ff6ffaea3207c6c0933769dc9929e96d10642f869394275922891833b7c58
- SSDEEP 49152:F0ktHFMh6zvqnvs0+v+O57c+DVzqQ+U5WV8S7IcwVRRjFTE96J4nACYd02Ul+:ysTP7c+DNE/l6RROQ+
- TLSH T161168D60FDDB50F9EA03183145ABA27FA33467195335CBC7C7401E9AE86BAE15D33229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-steal.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-22_0665dea4dcaa7eab82b14b46feb7387e_amadey_cobalt-strike_coinminer_elex_glassworm_luca-stealer_mespinoza_njrat_poet-rat_remcos_smoke-loader
- Size 3.9MB
- SHA256 c567f2b67d485fe319a9599b6a7a80d9d24e2646dc8bf6457b4e2b839a0d79a3
- MD5 0665dea4dcaa7eab82b14b46feb7387e
- SHA1 ca53dc5b050ee4b5775ed41ccb85bbc893852b25
- SHA512 dbb8f8b7691663c46ae081aa83268a1b776b36ddab83b298e60ef317a8dc32340c9ff6ffaea3207c6c0933769dc9929e96d10642f869394275922891833b7c58
- SSDEEP 49152:F0ktHFMh6zvqnvs0+v+O57c+DVzqQ+U5WV8S7IcwVRRjFTE96J4nACYd02Ul+:ysTP7c+DNE/l6RROQ+
- TLSH T161168D60FDDB50F9EA03183145ABA27FA33467195335CBC7C7401E9AE86BAE15D33229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext