General
- Target 2026-10-21_808aceb2be3b771b2147a06f8950c90c_amadey_cobalt-strike_elex_glassworm_remcos_smoke-loader_vidar
- Size 3.5MB
- Sample261022-ydyztatwex
- SHA256 7cf35396927e673f87690936323825f9120e6f51663d70b9fb3e603eccac0c5a
- MD5 808aceb2be3b771b2147a06f8950c90c
- SHA1 b5d88e96b06dc0e17be03933b3f308c94b92d26c
- SHA512 07f3b1c74c00c722acf77a1572415c2042a9503bdee7b3f5411709ab69e6f8894ec04cfd9f43cc10101e66a61603b3559a514730e4e64a7e8f797007219be860
- SSDEEP 49152:ZENwzIR257BVIqR6FoRvku04YLQlLXg3i4lQMaYkNU4CUPP/ax2KZF:ZgwkQ7TIqMeFRUs/s26F
- TLSH T115067C10A7608064FABBC2B5CABAD255E6357CB18B7861CF51D076ED0E326F09D36B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-21_808aceb2be3b771b2147a06f8950c90c_amadey_cobalt-strike_elex_glassworm_remcos_smoke-loader_vidar.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-21_808aceb2be3b771b2147a06f8950c90c_amadey_cobalt-strike_elex_glassworm_remcos_smoke-loader_vidar.exe
Resource
win11ltsc2024-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-21_808aceb2be3b771b2147a06f8950c90c_amadey_cobalt-strike_elex_glassworm_remcos_smoke-loader_vidar
- Size 3.5MB
- SHA256 7cf35396927e673f87690936323825f9120e6f51663d70b9fb3e603eccac0c5a
- MD5 808aceb2be3b771b2147a06f8950c90c
- SHA1 b5d88e96b06dc0e17be03933b3f308c94b92d26c
- SHA512 07f3b1c74c00c722acf77a1572415c2042a9503bdee7b3f5411709ab69e6f8894ec04cfd9f43cc10101e66a61603b3559a514730e4e64a7e8f797007219be860
- SSDEEP 49152:ZENwzIR257BVIqR6FoRvku04YLQlLXg3i4lQMaYkNU4CUPP/ax2KZF:ZgwkQ7TIqMeFRUs/s26F
- TLSH T115067C10A7608064FABBC2B5CABAD255E6357CB18B7861CF51D076ED0E326F09D36B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory