General
- Target 2026-08-27_e875ada3f7ef2e50d72f7ba76502683b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar_wannacry
- Size 18.0MB
- Sample260828-dvpr9aen8w
- SHA256 996adcd1517d4a92ae7c846615c9412ec61c679d291efa4add6d1f328d5011c7
- MD5 e875ada3f7ef2e50d72f7ba76502683b
- SHA1 404562acbc49aae823b3f9b80a951cefa42d6ff7
- SHA512 24405c9c290a55468f944405884516d888305261763c953982888280ae5be4d9c3e57f06bb9ebd829eab4fe659a418e7e10fe1bef399b6b77a82a3314ba45155
- SSDEEP 196608:HQdWQdd3Tf16UgTH2FQdWQdd3Tf16UgTH2W:UDUvTHzDUvTHb
- TLSH T1E6176B227295552EF16AED7AC35B7B29BA303C9B0B71848F9609B2382D717F15F35302
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-27_e875ada3f7ef2e50d72f7ba76502683b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-27_e875ada3f7ef2e50d72f7ba76502683b_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar_wannacry
- Size 18.0MB
- SHA256 996adcd1517d4a92ae7c846615c9412ec61c679d291efa4add6d1f328d5011c7
- MD5 e875ada3f7ef2e50d72f7ba76502683b
- SHA1 404562acbc49aae823b3f9b80a951cefa42d6ff7
- SHA512 24405c9c290a55468f944405884516d888305261763c953982888280ae5be4d9c3e57f06bb9ebd829eab4fe659a418e7e10fe1bef399b6b77a82a3314ba45155
- SSDEEP 196608:HQdWQdd3Tf16UgTH2FQdWQdd3Tf16UgTH2W:UDUvTHzDUvTHb
- TLSH T1E6176B227295552EF16AED7AC35B7B29BA303C9B0B71848F9609B2382D717F15F35302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Executes dropped EXE
-
Drops file in System32 directory