General
- Target 2026-09-16_1997d9e523bb0d569d78ec4684c08dfa_amadey_cobalt-strike_elex_glassworm_remcos_smoke-loader_vidar
- Size 3.5MB
- Sample260916-hhfe9stzev
- SHA256 f875d09d67f1a623ff3d3848b6540527705fd7fd76fb8ddaccbdf50ca3de369a
- MD5 1997d9e523bb0d569d78ec4684c08dfa
- SHA1 3c034d64a4008c38c4d48364cef5e52672af57f7
- SHA512 3902ad969d060bb23dc05f9c5745c204f2606c2555dbbb1631883568806bad49c2935b219e8a2c591e6f2763103e9bc95fef5ae92e56fa475764e5468c1b3777
- SSDEEP 49152:tENwzIR257BlIqR6FoRvku04YLfy83pZ3kd0CuEeN0LUmRXtYs65m:tgwkQ7TIqMeYuKuUeY15
- TLSH T183067D11A7608064FABBC2B4CABAD255E6357CB14B78A1CF51D076ED0E326F09D36B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-16_1997d9e523bb0d569d78ec4684c08dfa_amadey_cobalt-strike_elex_glassworm_remcos_smoke-loader_vidar.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-16_1997d9e523bb0d569d78ec4684c08dfa_amadey_cobalt-strike_elex_glassworm_remcos_smoke-loader_vidar.exe
Resource
win11ltsc2024-20260911-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-16_1997d9e523bb0d569d78ec4684c08dfa_amadey_cobalt-strike_elex_glassworm_remcos_smoke-loader_vidar
- Size 3.5MB
- SHA256 f875d09d67f1a623ff3d3848b6540527705fd7fd76fb8ddaccbdf50ca3de369a
- MD5 1997d9e523bb0d569d78ec4684c08dfa
- SHA1 3c034d64a4008c38c4d48364cef5e52672af57f7
- SHA512 3902ad969d060bb23dc05f9c5745c204f2606c2555dbbb1631883568806bad49c2935b219e8a2c591e6f2763103e9bc95fef5ae92e56fa475764e5468c1b3777
- SSDEEP 49152:tENwzIR257BlIqR6FoRvku04YLfy83pZ3kd0CuEeN0LUmRXtYs65m:tgwkQ7TIqMeYuKuUeY15
- TLSH T183067D11A7608064FABBC2B4CABAD255E6357CB14B78A1CF51D076ED0E326F09D36B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory