General
- Target 2026-06-28_57e4963ef4714d3efaf20fc8854d6d78_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 13.4MB
- Sample260628-2e6mtsgt4n
- SHA256 b78ffb7af2e36ae3ef45d8109bab08356774b73b10cc023f54e0ac27bf8b8c48
- MD5 57e4963ef4714d3efaf20fc8854d6d78
- SHA1 768d3df96a6a88a3e75cbc801ccf3435506ca90b
- SHA512 a1fdd4a23f9c7a31ef1eaf0864b7a75c6e2482c488d7a68db2cc6186757788468f0879c40d6a26c205965fa54aeb7098e4bce30a4fec7f8fa9a00614adf32b1d
- SSDEEP 196608:Qdn2S9+ULdNpcIa6QHteGZF6bUpMBF1p/kjRm4OWi2b4dT:E2SlLdNqIQHhIbUwF1VERmj2bk
- TLSH T146E6CF22F6B44232C0679072CE969665EAB27C554BF0CBD71345B2DC2F332D2BA36725
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-06-28_57e4963ef4714d3efaf20fc8854d6d78_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_57e4963ef4714d3efaf20fc8854d6d78_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 13.4MB
- SHA256 b78ffb7af2e36ae3ef45d8109bab08356774b73b10cc023f54e0ac27bf8b8c48
- MD5 57e4963ef4714d3efaf20fc8854d6d78
- SHA1 768d3df96a6a88a3e75cbc801ccf3435506ca90b
- SHA512 a1fdd4a23f9c7a31ef1eaf0864b7a75c6e2482c488d7a68db2cc6186757788468f0879c40d6a26c205965fa54aeb7098e4bce30a4fec7f8fa9a00614adf32b1d
- SSDEEP 196608:Qdn2S9+ULdNpcIa6QHteGZF6bUpMBF1p/kjRm4OWi2b4dT:E2SlLdNqIQHhIbUwF1VERmj2bk
- TLSH T146E6CF22F6B44232C0679072CE969665EAB27C554BF0CBD71345B2DC2F332D2BA36725
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1