General
- Target 2026-10-23_f534807806735b20fa0c3d6e816d4a63_amadey_cobalt-strike_darkgate_glassworm_icedid_remcos_ryuk_satacom_smoke-loader
- Size 30.0MB
- Sample261023-gdpmpscc56
- SHA256 0905cffe6f2a20de5143e2515210a0c9c67bd441cd35aa7fc788e49beea6ac69
- MD5 f534807806735b20fa0c3d6e816d4a63
- SHA1 6a6544651439a3093e9465ced83c152f08a7b7f1
- SHA512 d50b779e7381be81272770c9dd22e154dad5cefdc8fb42acb2bb5f73f87937e332103cad37133a72fdde7763981dc06b8d1177e642a17afd38bea43657a0ee34
- SSDEEP 393216:/chX91fn5AHkUFN0Dg7OtgxlLJFppJYcl72QVtSqcEmKsZ4i+QR:/g1fnukI20ytgxltHpJp72QbSqcbbR
- TLSH T11F679D01B7D84471EAF72632352AA736553EBD201FA281CB679566AE3C71BC19E3031F
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-23_f534807806735b20fa0c3d6e816d4a63_amadey_cobalt-strike_darkgate_glassworm_icedid_remcos_ryuk_satacom_smoke-loader.exe
Resource
win10v2004-20260911-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-23_f534807806735b20fa0c3d6e816d4a63_amadey_cobalt-strike_darkgate_glassworm_icedid_remcos_ryuk_satacom_smoke-loader.exe
Resource
win11ltsc2024-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-23_f534807806735b20fa0c3d6e816d4a63_amadey_cobalt-strike_darkgate_glassworm_icedid_remcos_ryuk_satacom_smoke-loader
- Size 30.0MB
- SHA256 0905cffe6f2a20de5143e2515210a0c9c67bd441cd35aa7fc788e49beea6ac69
- MD5 f534807806735b20fa0c3d6e816d4a63
- SHA1 6a6544651439a3093e9465ced83c152f08a7b7f1
- SHA512 d50b779e7381be81272770c9dd22e154dad5cefdc8fb42acb2bb5f73f87937e332103cad37133a72fdde7763981dc06b8d1177e642a17afd38bea43657a0ee34
- SSDEEP 393216:/chX91fn5AHkUFN0Dg7OtgxlLJFppJYcl72QVtSqcEmKsZ4i+QR:/g1fnukI20ytgxltHpJp72QbSqcbbR
- TLSH T11F679D01B7D84471EAF72632352AA736553EBD201FA281CB679566AE3C71BC19E3031F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Suspicious use of SetThreadContext