General
- Target 2026-08-27_1207ff55f6196c68e105aed2e4e478f1_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar
- Size 5.0MB
- Sample260827-2mda9abb99
- SHA256 05cddaec75bdc115d055f2f6ed6011b26cc1f27580c17eb3309691c391cc5cae
- MD5 1207ff55f6196c68e105aed2e4e478f1
- SHA1 0ef21a4afeb082265e8049379d88d8cefa8fa754
- SHA512 4bea004fc87b28e64d232c45f0aa6dd5b2d6f3cadd97946deb11b7a7dffba63ec6237984cc0698e91d65d316336d2efb161e63bc6ff221c584b099b7a1cfced4
- SSDEEP 49152:TDHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJfogA2eQJbXp1qJtb2Y:0pGfQJdXN0B7+sitq2eQhhLrOxrX
- TLSH T1AD365B1672A84AB5E07B4134C5A24259D6737C219F328BCF12906EAD7FB36C19D36B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-27_1207ff55f6196c68e105aed2e4e478f1_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_gl.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-27_1207ff55f6196c68e105aed2e4e478f1_amadey_cloudeye_cobalt-strike_coinminer_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar
- Size 5.0MB
- SHA256 05cddaec75bdc115d055f2f6ed6011b26cc1f27580c17eb3309691c391cc5cae
- MD5 1207ff55f6196c68e105aed2e4e478f1
- SHA1 0ef21a4afeb082265e8049379d88d8cefa8fa754
- SHA512 4bea004fc87b28e64d232c45f0aa6dd5b2d6f3cadd97946deb11b7a7dffba63ec6237984cc0698e91d65d316336d2efb161e63bc6ff221c584b099b7a1cfced4
- SSDEEP 49152:TDHXJOpL1M84pvoJdXN0BMOwLloBrugYy6i1zuajsauZnJfogA2eQJbXp1qJtb2Y:0pGfQJdXN0B7+sitq2eQhhLrOxrX
- TLSH T1AD365B1672A84AB5E07B4134C5A24259D6737C219F328BCF12906EAD7FB36C19D36B33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory