General
- Target 2026-11-12_5754bf10fce3390c7f1547d25d9c78c1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_stealc_vidar
- Size 9.2MB
- Sample261113-c5l9faft7j
- SHA256 6abecc3b78dcc701b00285edb8c3ffc417abfadca37ef846d0afd54c8dfedec6
- MD5 5754bf10fce3390c7f1547d25d9c78c1
- SHA1 3682ee792dfb32593f67474ca25fc67284078133
- SHA512 281bc50744873e244f2a41d257fecdb9ac81db32d4f2515973601bb62261e4375579a38fe819d9ccb55a708656e1b06ea97e1ba391ba3868af37ed750d8e977f
- SSDEEP 98304:5ZKUgTH2M2m9UMpu1QfLczqssnKSm63fkZcvTIOSAg:5PgTH2qBpu1QfLIqsufm6PvTfc
- TLSH T1B8A64A1222E98F9DD06F9438CD1669B566237C568F319FCF2840BE293E727A05E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-11-12_5754bf10fce3390c7f1547d25d9c78c1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-12_5754bf10fce3390c7f1547d25d9c78c1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win11ltsc2024-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-12_5754bf10fce3390c7f1547d25d9c78c1_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_stealc_vidar
- Size 9.2MB
- SHA256 6abecc3b78dcc701b00285edb8c3ffc417abfadca37ef846d0afd54c8dfedec6
- MD5 5754bf10fce3390c7f1547d25d9c78c1
- SHA1 3682ee792dfb32593f67474ca25fc67284078133
- SHA512 281bc50744873e244f2a41d257fecdb9ac81db32d4f2515973601bb62261e4375579a38fe819d9ccb55a708656e1b06ea97e1ba391ba3868af37ed750d8e977f
- SSDEEP 98304:5ZKUgTH2M2m9UMpu1QfLczqssnKSm63fkZcvTIOSAg:5PgTH2qBpu1QfLIqsufm6PvTfc
- TLSH T1B8A64A1222E98F9DD06F9438CD1669B566237C568F319FCF2840BE293E727A05E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detects executables containing URLs to raw contents of a Github gist
- Custom signature
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Custom signature
Detects executables packed with ASPack
Executes dropped EXE
Adds Run key to start application