General
- Target 2026-10-21_a15b8d67b6035650eadef79060fc947c_amadey_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_stop_vidar
- Size 15.8MB
- Sample261022-sha6navv7n
- SHA256 e6863f2fe9011177817ebecad5a126e5e4d8a79f3d962f0486556d4d2a27d869
- MD5 a15b8d67b6035650eadef79060fc947c
- SHA1 593704040d772b87d7ee1dbb9ea02287abcec3af
- SHA512 332aa20f3024dbd31d4e93067f9c410ea25d1d75e63880d6ba684a46c00828ebbcaff877779e7d4a612f3c4c703395d6a92a035e396e4141558a7b6a2e936387
- SSDEEP 196608:HVmj5TDdTjbeGZF6bUpMBF1p/kjRm4OWi2bgdj5jEmHpn6F44IAWvK:HwTPIbUwF1VERmj2bA1QmHN6+JrvK
- TLSH T16AF6BE5162A765F8E0AF9135893A8731E6767C130E31838F12BCDA5A3F736906D39723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-10-21_a15b8d67b6035650eadef79060fc947c_amadey_cobalt-strike_coinminer_elex_glassworm_hawkeye_hi.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-21_a15b8d67b6035650eadef79060fc947c_amadey_cobalt-strike_coinminer_elex_glassworm_hawkeye_hi.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-21_a15b8d67b6035650eadef79060fc947c_amadey_cobalt-strike_coinminer_elex_glassworm_hawkeye_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_stop_vidar
- Size 15.8MB
- SHA256 e6863f2fe9011177817ebecad5a126e5e4d8a79f3d962f0486556d4d2a27d869
- MD5 a15b8d67b6035650eadef79060fc947c
- SHA1 593704040d772b87d7ee1dbb9ea02287abcec3af
- SHA512 332aa20f3024dbd31d4e93067f9c410ea25d1d75e63880d6ba684a46c00828ebbcaff877779e7d4a612f3c4c703395d6a92a035e396e4141558a7b6a2e936387
- SSDEEP 196608:HVmj5TDdTjbeGZF6bUpMBF1p/kjRm4OWi2bgdj5jEmHpn6F44IAWvK:HwTPIbUwF1VERmj2bA1QmHN6+JrvK
- TLSH T16AF6BE5162A765F8E0AF9135893A8731E6767C130E31838F12BCDA5A3F736906D39723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
UPX dump on OEP (original entry point)
-
Drops file in System32 directory