General
- Target 2026-09-29_39792f4d2bac4d273206e0efa0c04ff9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_nymaim_ramnit_rhadamanthys_smoke-loader_stealc_stop_vidar_wannacry
- Size 12.1MB
- Sample260930-df3essxvbs
- SHA256 dc7a92269441a18f0b8aa3b019f4bb88ac44c278bec778abe088cdc04e41ec11
- MD5 39792f4d2bac4d273206e0efa0c04ff9
- SHA1 f176299d55d77a808935fb669bf39dcfc32cfc03
- SHA512 bca1a885ca5b505528e440087392783ed90f182cbf8396dbea78815fc8e9e80a34dc0c1632d55685a3e1c336096e26f3d7a9fb7d82ba4b788e99f7800e94db1f
- SSDEEP 98304:CdYOXwnS4rVR5v77GBfWx77GBfWGLsRoq2VjnmZTvUko/Sz6j0I8NiJoq2Vjnmk:nIcRGBfW1GBfWnGnGTo/Eq08JGnV
- TLSH T1BFD66C0573A840E2D0B1A1B4C8265795E3B2BD745B32D6EF5A983A0E7E33FC44D3A365
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_39792f4d2bac4d273206e0efa0c04ff9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win10v2004-20260911-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-29_39792f4d2bac4d273206e0efa0c04ff9_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_nymaim_ramnit_rhadamanthys_smoke-loader_stealc_stop_vidar_wannacry
- Size 12.1MB
- SHA256 dc7a92269441a18f0b8aa3b019f4bb88ac44c278bec778abe088cdc04e41ec11
- MD5 39792f4d2bac4d273206e0efa0c04ff9
- SHA1 f176299d55d77a808935fb669bf39dcfc32cfc03
- SHA512 bca1a885ca5b505528e440087392783ed90f182cbf8396dbea78815fc8e9e80a34dc0c1632d55685a3e1c336096e26f3d7a9fb7d82ba4b788e99f7800e94db1f
- SSDEEP 98304:CdYOXwnS4rVR5v77GBfWx77GBfWGLsRoq2VjnmZTvUko/Sz6j0I8NiJoq2Vjnmk:nIcRGBfW1GBfWnGnGTo/Eq08JGnV
- TLSH T1BFD66C0573A840E2D0B1A1B4C8265795E3B2BD745B32D6EF5A983A0E7E33FC44D3A365
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1