General
- Target 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry
- Size 6.7MB
- Sample261015-y1tzdaeb24
- SHA256 84c223503c4d23efe77248eabb64afd7b0fb3fcd18167134657af65a81f8d09b
- MD5 08950b2af48c1aa1aa7a4890eaefab88
- SHA1 3c9882abf4511753a11db7be307a59881874c9e3
- SHA512 5a20b13037e3c3f1d31b0cbd969197d97d1ff7779cd566a0485a1360e0b1ce46455570c4da562b8cda405989d45f8142c009d1fab38ab81ea128ae58a7e73fec
- SSDEEP 49152:kdJDp5AVBXdct+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyWT3S9tsgXp:kTzodN0oAaldmdmnpWTIOSAW6w
- TLSH T18B667C03B2E405A6E06AD23DC972453997717C2E8BF2D2DF3144B9DA2D72BC17A36712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry
- Size 6.7MB
- SHA256 84c223503c4d23efe77248eabb64afd7b0fb3fcd18167134657af65a81f8d09b
- MD5 08950b2af48c1aa1aa7a4890eaefab88
- SHA1 3c9882abf4511753a11db7be307a59881874c9e3
- SHA512 5a20b13037e3c3f1d31b0cbd969197d97d1ff7779cd566a0485a1360e0b1ce46455570c4da562b8cda405989d45f8142c009d1fab38ab81ea128ae58a7e73fec
- SSDEEP 49152:kdJDp5AVBXdct+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyWT3S9tsgXp:kTzodN0oAaldmdmnpWTIOSAW6w
- TLSH T18B667C03B2E405A6E06AD23DC972453997717C2E8BF2D2DF3144B9DA2D72BC17A36712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Drops file in System32 directory