General
- Target 2026-10-22_66038cdd8142b5bc5e168beba941cf24_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry
- Size 20.3MB
- Sample261024-mna5ysht31
- SHA256 dd44ebf5ae51ae284e45eb24782eea502e38de58d8d9319cdef0703aa5ad2649
- MD5 66038cdd8142b5bc5e168beba941cf24
- SHA1 2d55a95504b0f6259d60bac7ff471897b5e06833
- SHA512 cc3814cd9cd7b0d42a992eb326bfb1d19d42d7bba2e6b3933b85ea5ff2825953f5c52456bbd2b0aaaf6f18e9e8f4df0e4e6ed59210995211f3cf302a3e705271
- SSDEEP 196608:IScIFWyZ/K0ttYVAATm/h1+IGn1ScIFWyZ/K0ttYVAATm/h1+IGnK:Q/yZ/K0ttYZTYGt/yZ/K0ttYZTYG
- TLSH T115276C13B2E440A5D1AAD174CF668732E7727C198BF196EF224076D92E33AD07B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_66038cdd8142b5bc5e168beba941cf24_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_66038cdd8142b5bc5e168beba941cf24_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_66038cdd8142b5bc5e168beba941cf24_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry
- Size 20.3MB
- SHA256 dd44ebf5ae51ae284e45eb24782eea502e38de58d8d9319cdef0703aa5ad2649
- MD5 66038cdd8142b5bc5e168beba941cf24
- SHA1 2d55a95504b0f6259d60bac7ff471897b5e06833
- SHA512 cc3814cd9cd7b0d42a992eb326bfb1d19d42d7bba2e6b3933b85ea5ff2825953f5c52456bbd2b0aaaf6f18e9e8f4df0e4e6ed59210995211f3cf302a3e705271
- SSDEEP 196608:IScIFWyZ/K0ttYVAATm/h1+IGn1ScIFWyZ/K0ttYVAATm/h1+IGnK:Q/yZ/K0ttYZTYGt/yZ/K0ttYZTYG
- TLSH T115276C13B2E440A5D1AAD174CF668732E7727C198BF196EF224076D92E33AD07B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry