General
- Target 2026-08-25_a58f5b04b5f4574c1b02ba283ee7afac_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.5MB
- Sample260826-rz4nvseq8v
- SHA256 3b84be7eb160c569d28c845bbb81f32b7ebc53f31db85585a4bc4fa24268f44d
- MD5 a58f5b04b5f4574c1b02ba283ee7afac
- SHA1 5602dcfb5ec6b3c8d42b4a3612ac77cc057bfc1b
- SHA512 5bd6f25499e2bb7397061158f23e79793c8005c477716d2c7dcb9d1046d12edcca6a4762febf0e24efe9727b86d397b80ee0a4acb3c01ef67ea479f8e5435460
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6hp5Ra8w0Le5ji0hmxNrM:A3kM8ljVPji0Aj
- TLSH T1BB758D22FA748275D177C475CAE2975AEA7138510B308ACB9398C76C2F237D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-25_a58f5b04b5f4574c1b02ba283ee7afac_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-25_a58f5b04b5f4574c1b02ba283ee7afac_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-25_a58f5b04b5f4574c1b02ba283ee7afac_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hijackloader_icedid_njrat_smoke-loader_vidar_wannacry
- Size 1.5MB
- SHA256 3b84be7eb160c569d28c845bbb81f32b7ebc53f31db85585a4bc4fa24268f44d
- MD5 a58f5b04b5f4574c1b02ba283ee7afac
- SHA1 5602dcfb5ec6b3c8d42b4a3612ac77cc057bfc1b
- SHA512 5bd6f25499e2bb7397061158f23e79793c8005c477716d2c7dcb9d1046d12edcca6a4762febf0e24efe9727b86d397b80ee0a4acb3c01ef67ea479f8e5435460
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6hp5Ra8w0Le5ji0hmxNrM:A3kM8ljVPji0Aj
- TLSH T1BB758D22FA748275D177C475CAE2975AEA7138510B308ACB9398C76C2F237D19B3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory