General
- Target 2026-09-23_ac5003255cc0809cf44897a45e850152_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_smoke-loader_stop_tofsee_vidar_wannacry
- Size 3.9MB
- Sample260923-xt3ghaae33
- SHA256 0c41afe39dfe746e0c13f26f54e5f865f72956b7b16c918f5ea3632dfcc8b08e
- MD5 ac5003255cc0809cf44897a45e850152
- SHA1 a92e5d1cb2dbcf93746d0e3fa5c2e4d50319c6dd
- SHA512 282deae383a57bc1e84f5998a89711964188b4356fdbcf680224ced5f618e41721de133d186eb916774a6db6d306aebfa5c9ac1bce39beb8ecf06b7e528ddda4
- SSDEEP 49152:kpC0biT3S9tsgX8zEC8ULgCSA/Bkj0nPji0AjQpYq/:kIOiTIOSANjoM6M
- TLSH T101168C1273E48637E07A927EC0B10A7DD771753B9B36C78F3504A9AE5DA27828527323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-09-23_ac5003255cc0809cf44897a45e850152_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-23_ac5003255cc0809cf44897a45e850152_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-23_ac5003255cc0809cf44897a45e850152_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_smoke-loader_stop_tofsee_vidar_wannacry
- Size 3.9MB
- SHA256 0c41afe39dfe746e0c13f26f54e5f865f72956b7b16c918f5ea3632dfcc8b08e
- MD5 ac5003255cc0809cf44897a45e850152
- SHA1 a92e5d1cb2dbcf93746d0e3fa5c2e4d50319c6dd
- SHA512 282deae383a57bc1e84f5998a89711964188b4356fdbcf680224ced5f618e41721de133d186eb916774a6db6d306aebfa5c9ac1bce39beb8ecf06b7e528ddda4
- SSDEEP 49152:kpC0biT3S9tsgX8zEC8ULgCSA/Bkj0nPji0AjQpYq/:kIOiTIOSANjoM6M
- TLSH T101168C1273E48637E07A927EC0B10A7DD771753B9B36C78F3504A9AE5DA27828527323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory