General
- Target 2026-10-22_83e6190e117e97d38e3899d74c59fa56_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stealc_vidar
- Size 12.7MB
- Sample261024-g8a3ssas2q
- SHA256 8a1c96dff94d7b9976f4337384345a41fa4f8be9dcb512c21d027ce7152b9b20
- MD5 83e6190e117e97d38e3899d74c59fa56
- SHA1 bd8aa1dd47e64f0ddae81adb51db0c9a2f49db9a
- SHA512 c0526dcc4b15867d4bbfb499fa55d9d08ff830609fcec3ce33162e9fb8f407819515fb180d59cd6fc5f419cc79d1284a051ef463e2949a2f7ac3240797f18858
- SSDEEP 98304:ImRUcfT1611PFgb+0ChEPIGiq3y3vx+w9TbfjJ+kdfpK46Tle36jknz9t:YckPM+kIGv3y/x+KTbfjJ+kdnAlejt
- TLSH T17BD67D1BA2E800D9D0BAD178DA1B4A52F672B816037197DF13D0856E1FB7BE0CE79721
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-10-22_83e6190e117e97d38e3899d74c59fa56_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
2026-10-22_83e6190e117e97d38e3899d74c59fa56_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hija.exe
Resource
win11ltsc2024-20260911-en
Malware Config
Targets
-
- Target 2026-10-22_83e6190e117e97d38e3899d74c59fa56_akira_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stealc_vidar
- Size 12.7MB
- SHA256 8a1c96dff94d7b9976f4337384345a41fa4f8be9dcb512c21d027ce7152b9b20
- MD5 83e6190e117e97d38e3899d74c59fa56
- SHA1 bd8aa1dd47e64f0ddae81adb51db0c9a2f49db9a
- SHA512 c0526dcc4b15867d4bbfb499fa55d9d08ff830609fcec3ce33162e9fb8f407819515fb180d59cd6fc5f419cc79d1284a051ef463e2949a2f7ac3240797f18858
- SSDEEP 98304:ImRUcfT1611PFgb+0ChEPIGiq3y3vx+w9TbfjJ+kdfpK46Tle36jknz9t:YckPM+kIGv3y/x+KTbfjJ+kdnAlejt
- TLSH T17BD67D1BA2E800D9D0BAD178DA1B4A52F672B816037197DF13D0856E1FB7BE0CE79721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1