General
- Target 2026-10-14_a04333440b69e8c1be9b9a5e2b0aad1b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_ipamor_luca-stealer_njrat_remcos_rhadamanthys_stealc_vidar
- Size 9.2MB
- Sample261014-s13cvsxtew
- SHA256 586dec50be79bb08bd61d66b3e26918222d196e0e9e25e309a3ac311e9663499
- MD5 a04333440b69e8c1be9b9a5e2b0aad1b
- SHA1 e105efbb7c20f04bfc6ffa769889673552dd3880
- SHA512 84d691e36f91737d4eba4d752fc7d1c2e50aff566cfafba6284d223ed3e1151b57fb0ab47f083c81804ad63b402c819b63db3a3cc2897492cd176416367cfd01
- SSDEEP 98304:ktLKUgTH2M2m9UMpu1QfLczqssnKSJfkZckTTIOSAL:4gTH2qBpu1QfLIqsufVPkTTf/
- TLSH T197A64A1222E98F9DD06F9438CD1669B566237C568F319FCF2840BE293E727A05E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-10-14_a04333440b69e8c1be9b9a5e2b0aad1b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-14_a04333440b69e8c1be9b9a5e2b0aad1b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win11ltsc2024-20260911-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-14_a04333440b69e8c1be9b9a5e2b0aad1b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_ipamor_luca-stealer_njrat_remcos_rhadamanthys_stealc_vidar
- Size 9.2MB
- SHA256 586dec50be79bb08bd61d66b3e26918222d196e0e9e25e309a3ac311e9663499
- MD5 a04333440b69e8c1be9b9a5e2b0aad1b
- SHA1 e105efbb7c20f04bfc6ffa769889673552dd3880
- SHA512 84d691e36f91737d4eba4d752fc7d1c2e50aff566cfafba6284d223ed3e1151b57fb0ab47f083c81804ad63b402c819b63db3a3cc2897492cd176416367cfd01
- SSDEEP 98304:ktLKUgTH2M2m9UMpu1QfLczqssnKSJfkZckTTIOSAL:4gTH2qBpu1QfLIqsufVPkTTf/
- TLSH T197A64A1222E98F9DD06F9438CD1669B566237C568F319FCF2840BE293E727A05E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables packed with ASPack
-
Executes dropped EXE
-
Adds Run key to start application