General
- Target 2026-06-27_00eafa2db1994d78ae5af718d616d44d_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar_wannacry
- Size 6.7MB
- Sample260629-mq9rasds2l
- SHA256 6c6ade97f9c38dae5057ef424371a272dbafaa26a0cfd3e306a3a37bd1c05b8c
- MD5 00eafa2db1994d78ae5af718d616d44d
- SHA1 3f008e2f4ed47c51dd5946485d83617fae1b7bc3
- SHA512 f8d5ab73cf6c620be2e56699b32ef1a10e48c6932b5ff1618aee8f3f92d7f16e2df9c34effc5d4e18f821d12215012c0f042e94f5325ff40a3d4d9710cd6317f
- SSDEEP 49152:PabH/QoIyNabH/HJVBXdcWabH/3IyNabH/HJVBXdcT4qiw3PASW9mMtA+Cq99Lyf:uIyatduIyatdtgPALh0oAaldmdmnpEX
- TLSH T1F8666B22714145AAF119EE36CB0AB324BA207C990FF185DFE64877D92A366F03F76345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_00eafa2db1994d78ae5af718d616d44d_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_00eafa2db1994d78ae5af718d616d44d_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win11ltsc2024-20260618-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-27_00eafa2db1994d78ae5af718d616d44d_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar_wannacry
- Size 6.7MB
- SHA256 6c6ade97f9c38dae5057ef424371a272dbafaa26a0cfd3e306a3a37bd1c05b8c
- MD5 00eafa2db1994d78ae5af718d616d44d
- SHA1 3f008e2f4ed47c51dd5946485d83617fae1b7bc3
- SHA512 f8d5ab73cf6c620be2e56699b32ef1a10e48c6932b5ff1618aee8f3f92d7f16e2df9c34effc5d4e18f821d12215012c0f042e94f5325ff40a3d4d9710cd6317f
- SSDEEP 49152:PabH/QoIyNabH/HJVBXdcWabH/3IyNabH/HJVBXdcT4qiw3PASW9mMtA+Cq99Lyf:uIyatduIyatdtgPALh0oAaldmdmnpEX
- TLSH T1F8666B22714145AAF119EE36CB0AB324BA207C990FF185DFE64877D92A366F03F76345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1