General
- Target 2026-05-22_2f482c9a6d84e7c032420cd4856655e9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_njrat_remcos_smoke-loader_stealc_vidar
- Size 13.1MB
- Sample260522-tcl7eaaz7w
- SHA256 9cc36ea0fc1719479cd012cfdaf304a8f5f5968a1c4e09cd3cf54be27625c87f
- MD5 2f482c9a6d84e7c032420cd4856655e9
- SHA1 e6f342f57c3ed2f44c2c066c80558c6d17d6bd60
- SHA512 fd9d07c8c8b32c733e6bf1ceba38520d71168b22ec8f6e20d9137d90a4d8fccd30e52137f5e03a77cdfea1cdb69798cecb57e56c6317e29c46e5ec1363e22db2
- SSDEEP 196608:2IpgdncIzdOqugTH2qBpu1QfLIqsufljqy:2In89THNBpu1Qfc0Yy
- TLSH T14ED63A1262D58FA8C05F9430CE4666B5AA633C558FB09BDF15807E693E726E07E3831F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-05-22_2f482c9a6d84e7c032420cd4856655e9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-22_2f482c9a6d84e7c032420cd4856655e9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_njrat_remcos_smoke-loader_stealc_vidar
- Size 13.1MB
- SHA256 9cc36ea0fc1719479cd012cfdaf304a8f5f5968a1c4e09cd3cf54be27625c87f
- MD5 2f482c9a6d84e7c032420cd4856655e9
- SHA1 e6f342f57c3ed2f44c2c066c80558c6d17d6bd60
- SHA512 fd9d07c8c8b32c733e6bf1ceba38520d71168b22ec8f6e20d9137d90a4d8fccd30e52137f5e03a77cdfea1cdb69798cecb57e56c6317e29c46e5ec1363e22db2
- SSDEEP 196608:2IpgdncIzdOqugTH2qBpu1QfLIqsufljqy:2In89THNBpu1Qfc0Yy
- TLSH T14ED63A1262D58FA8C05F9430CE4666B5AA633C558FB09BDF15807E693E726E07E3831F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1