futurax | 2026-06-27_9d5ab561e65514a51e5fe9739e9b3143_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_9d5ab561e65514a51e5fe9739e9b3143_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
Size 15.5MB
Sample260629-e87qnaev2m
SHA256 04fa2fdee33ba3d95669803df77669d7a182c222d573920c5e31ff73a2e0ac4e
MD5 9d5ab561e65514a51e5fe9739e9b3143
SHA1 2bbc235ece521dbeece3b4f7bbab0a3742de784b
SHA512 5a5283eb9039a2b24c769f3cc48b2efe9f8199150b72aa08e2fdeff4fa798bb9154b84c1eebbec198e3e0fb64502b212f5532b91bd1786158b5c67520f40d3cd
SSDEEP 196608:ski9XwgwAMtPdf5P6ncIZ6NcIZTf2eGZF6bUpMBF1p/kjRm4OWi2bC:j+Ajxh55h+KmIbUwF1VERmj2bC
TLSH
T19CF6CF1272E00566E1AA8139CE615639A7B17C3A8BF2D3DF3144B6DD1E727C0BA36713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm futurax

Malware Config

Signatures

Family: Futurax
Futurax is a Windows worm written in Delphi.
worm futurax

Detects Futurax 1 IoCs

resource	yara_rule
sample	family_futurax

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables packed with MEW 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_MEW

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-27_9d5ab561e65514a51e5fe9739e9b3143_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry

File Explorer

2026-06-27_9d5ab561e65514a51e5fe9739e9b3143_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry

.exe 15.5MB
downloader_req.pyc

574B

2026-06-27_9d5ab561e65514a51e5fe9739e9b3143_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry

SHA256 04fa2fdee33ba3d95669803df77669d7a182c222d573920c5e31ff73a2e0ac4e
MD5 9d5ab561e65514a51e5fe9739e9b3143
SHA1 2bbc235ece521dbeece3b4f7bbab0a3742de784b
SHA512 5a5283eb9039a2b24c769f3cc48b2efe9f8199150b72aa08e2fdeff4fa798bb9154b84c1eebbec198e3e0fb64502b212f5532b91bd1786158b5c67520f40d3cd
SSDEEP 196608:ski9XwgwAMtPdf5P6ncIZ6NcIZTf2eGZF6bUpMBF1p/kjRm4OWi2bC:j+Ajxh55h+KmIbUwF1VERmj2bC
TLSH
T19CF6CF1272E00566E1AA8139CE615639A7B17C3A8BF2D3DF3144B6DD1E727C0BA36713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Futurax
Detects executables containing URLs to raw contents of a Github gist
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables packed with MEW
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths