General
- Target 2026-04-16_f5a76c812672d9d6099aa5f35e60a6a2_amadey_blackenergy_coinminer_darkgate_elex_emotet_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop
- Size 6.8MB
- Sample260416-kejdvset6v
- SHA256 0baa127b64874b204b7efae42cd571631cd1e5fc6e458b31a599b6117276a640
- MD5 f5a76c812672d9d6099aa5f35e60a6a2
- SHA1 cab61ca0f403147989d6405d53b8ba7f66946f7d
- SHA512 7a7a3bb52237c256fd3c1403c79f96af205d4c62465debec7ff441c5bb282a76aa45d838f9cfdeb5ae6e3f8051f032bd6b944bcb3f0ad4d33c82262b18430cd7
- SSDEEP 98304:Ul77GBfWKHaHgfkZcXbXsPN5kiQaZ5Mjov:EGBfWtH+P85VPGov
- TLSH T16966C421A6E4CFA1D06F9071CCA6B6F5A5377C108F258FCB2A447E193A326D1993172F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-04-16_f5a76c812672d9d6099aa5f35e60a6a2_amadey_blackenergy_coinminer_darkgate_elex_emotet_hijack.exe
Resource
win10v2004-20260130-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-16_f5a76c812672d9d6099aa5f35e60a6a2_amadey_blackenergy_coinminer_darkgate_elex_emotet_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop
- Size 6.8MB
- SHA256 0baa127b64874b204b7efae42cd571631cd1e5fc6e458b31a599b6117276a640
- MD5 f5a76c812672d9d6099aa5f35e60a6a2
- SHA1 cab61ca0f403147989d6405d53b8ba7f66946f7d
- SHA512 7a7a3bb52237c256fd3c1403c79f96af205d4c62465debec7ff441c5bb282a76aa45d838f9cfdeb5ae6e3f8051f032bd6b944bcb3f0ad4d33c82262b18430cd7
- SSDEEP 98304:Ul77GBfWKHaHgfkZcXbXsPN5kiQaZ5Mjov:EGBfWtH+P85VPGov
- TLSH T16966C421A6E4CFA1D06F9071CCA6B6F5A5377C108F258FCB2A447E193A326D1993172F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1