General
- Target 2026-06-25_315676f76990aee0ce20832c3295a94e_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 15.0MB
- Sample260629-29fpwsav8p
- SHA256 259f2d1c316ea9d639d035762733195f9d993095941cc70b135b0287cb9b2a0e
- MD5 315676f76990aee0ce20832c3295a94e
- SHA1 d1e3e542acef3b59d3abec06d2eb96ada2e66978
- SHA512 46d6fa1c3982bbaee9d2ccf6ee6847447f5dcedf2d0d4eb3b1e3cc602235b51707b882305e177017018dea1180e375eead68ac32cce93aadac69b636c476e247
- SSDEEP 196608:ski9XwgwAMtPdf5P7qAdN6toSqFcIk6bd+eGZF6bUpMBF1p/kjRm4OWi2bE:j+Ajxh5OfiL2aQIbUwF1VERmj2bE
- TLSH T141F6D022B2E00175D1779131CFA69325EAB53C254BF0D6DB2344B6E91F336D0BA3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-06-25_315676f76990aee0ce20832c3295a94e_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-25_315676f76990aee0ce20832c3295a94e_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 15.0MB
- SHA256 259f2d1c316ea9d639d035762733195f9d993095941cc70b135b0287cb9b2a0e
- MD5 315676f76990aee0ce20832c3295a94e
- SHA1 d1e3e542acef3b59d3abec06d2eb96ada2e66978
- SHA512 46d6fa1c3982bbaee9d2ccf6ee6847447f5dcedf2d0d4eb3b1e3cc602235b51707b882305e177017018dea1180e375eead68ac32cce93aadac69b636c476e247
- SSDEEP 196608:ski9XwgwAMtPdf5P7qAdN6toSqFcIk6bd+eGZF6bUpMBF1p/kjRm4OWi2bE:j+Ajxh5OfiL2aQIbUwF1VERmj2bE
- TLSH T141F6D022B2E00175D1779131CFA69325EAB53C254BF0D6DB2344B6E91F336D0BA3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1