General
- Target 2026-09-03_8f04da86c61ace10afba58bb25269c73_akira_amadey_cobalt-strike_darkgate_glassworm_hijackloader_icedid_remcos_rhadamanthys_rusty-stealer_satacom_smoke-loader_stealc_vidar
- Size 30.0MB
- Sample260905-2smf4stgpb
- SHA256 a1c9f2ad378b80cece5b79f6d7f50bf66eac217d233e69101ab53d80bfde75a6
- MD5 8f04da86c61ace10afba58bb25269c73
- SHA1 d86bb7e245ed2698bcfc680274259d24ecdea484
- SHA512 6f8919acfd46e161679581450f4511586bf1b6b25baaeb09346a24e4710ecdd4c24b8c1ba757b2519bbcae0f67a677a26827a7cfb3566f087eba4be000708abc
- SSDEEP 393216:1Ei89+Q6SqBBgFaLD+b0ZUTsyUTeKvjBdw6WLWnJb9oRIM4uL8HFb:miQ6FDgFaLD+b0K5Yh
- TLSH T16067BF02B3E80066F5B7563499B78A12EA36BD611B31C3DF1294A26D1E73BC09F35727
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-09-03_8f04da86c61ace10afba58bb25269c73_akira_amadey_cobalt-strike_darkgate_glassworm_hijackload.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-03_8f04da86c61ace10afba58bb25269c73_akira_amadey_cobalt-strike_darkgate_glassworm_hijackload.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-03_8f04da86c61ace10afba58bb25269c73_akira_amadey_cobalt-strike_darkgate_glassworm_hijackloader_icedid_remcos_rhadamanthys_rusty-stealer_satacom_smoke-loader_stealc_vidar
- Size 30.0MB
- SHA256 a1c9f2ad378b80cece5b79f6d7f50bf66eac217d233e69101ab53d80bfde75a6
- MD5 8f04da86c61ace10afba58bb25269c73
- SHA1 d86bb7e245ed2698bcfc680274259d24ecdea484
- SHA512 6f8919acfd46e161679581450f4511586bf1b6b25baaeb09346a24e4710ecdd4c24b8c1ba757b2519bbcae0f67a677a26827a7cfb3566f087eba4be000708abc
- SSDEEP 393216:1Ei89+Q6SqBBgFaLD+b0ZUTsyUTeKvjBdw6WLWnJb9oRIM4uL8HFb:miQ6FDgFaLD+b0K5Yh
- TLSH T16067BF02B3E80066F5B7563499B78A12EA36BD611B31C3DF1294A26D1E73BC09F35727
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext