General
- Target 2026-10-24_ff66d3e963ab393ac92c0e11d81ff7e5_amadey_cobalt-strike_darkgate_glassworm_icedid_jaff_ryuk_satacom
- Size 7.6MB
- Sample261024-3t6rtaxxaz
- SHA256 3b810fb6283cbfe0d77bdedad0d7ee0202731fcd7b7aec3fd5e1b7b3ba036ada
- MD5 ff66d3e963ab393ac92c0e11d81ff7e5
- SHA1 f10f5fb6c9bdc11eca4e2d40adcd0d3a146e9c44
- SHA512 a40e4b53505d34633b746aeb6ed331ac6ed31cda202e221a898e479512a5cb09b39fb74b3964525eb3f0887003afd7c6cf9dfc886d0c304c678bb02f56e9ceaf
- SSDEEP 98304:6zm9db8F7LOiv8TNZUm6LN8emKQMcC+EOUyeuQ9JqZZcwYk:6CfMqiv8TNZUzN8emKQxEgpQ9JHk
- TLSH T1B786598BA69EC475E3B63D3ED4297633557E6BE01FA08DCB1254667928307C1BE3031A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-24_ff66d3e963ab393ac92c0e11d81ff7e5_amadey_cobalt-strike_darkgate_glassworm_icedid_jaff_ryuk_satacom.exe
Resource
win10v2004-20260911-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-24_ff66d3e963ab393ac92c0e11d81ff7e5_amadey_cobalt-strike_darkgate_glassworm_icedid_jaff_ryuk_satacom.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-24_ff66d3e963ab393ac92c0e11d81ff7e5_amadey_cobalt-strike_darkgate_glassworm_icedid_jaff_ryuk_satacom
- Size 7.6MB
- SHA256 3b810fb6283cbfe0d77bdedad0d7ee0202731fcd7b7aec3fd5e1b7b3ba036ada
- MD5 ff66d3e963ab393ac92c0e11d81ff7e5
- SHA1 f10f5fb6c9bdc11eca4e2d40adcd0d3a146e9c44
- SHA512 a40e4b53505d34633b746aeb6ed331ac6ed31cda202e221a898e479512a5cb09b39fb74b3964525eb3f0887003afd7c6cf9dfc886d0c304c678bb02f56e9ceaf
- SSDEEP 98304:6zm9db8F7LOiv8TNZUm6LN8emKQMcC+EOUyeuQ9JqZZcwYk:6CfMqiv8TNZUzN8emKQxEgpQ9JHk
- TLSH T1B786598BA69EC475E3B63D3ED4297633557E6BE01FA08DCB1254667928307C1BE3031A
- MD5 SHA1 SHA512 SSDEEP TLSH
Accesses cryptocurrency files/wallets, possible credential harvesting
Suspicious use of SetThreadContext