futurax | 2026-06-29_b88ceaf2c747ae667e2492bfb52f4280_amadey_blackenergy_elex_emotet_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-29_b88ceaf2c747ae667e2492bfb52f4280_amadey_blackenergy_elex_emotet_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop
Size 11.2MB
Sample260630-e2lvlsev8x
SHA256 9f8e8e3887499f31f12a6f55a7a0241c76392ea6ccc4fdf42eecde10dde78638
MD5 b88ceaf2c747ae667e2492bfb52f4280
SHA1 95cb4edee6b10bf25f0846abbd05f792a4373f11
SHA512 2b7ff04e293bb8855c3520a26305304eed654657ab2de97ddc862b1411250b051fcd96df8a9bc1684786bd65573c5595b2cc7d17d27e5361a092af03c27a60c8
SSDEEP 196608:EGBfWtpGBfWtaTfTeGZF6bUpMBF1p/kjRm4OWi2bm:FWUWsjIbUwF1VERmj2bm
TLSH
T1E4C6D01273F48136F0BB563E84B156789B767C269F36C64F3144A95E5EB3B82C922323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm futurax

Malware Config

Signatures

Family: Futurax
Futurax is a Windows worm written in Delphi.
worm futurax

Detects Futurax 1 IoCs

resource	yara_rule
sample	family_futurax

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables packed with MEW 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_MEW

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-29_b88ceaf2c747ae667e2492bfb52f4280_amadey_blackenergy_elex_emotet_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop

File Explorer

2026-06-29_b88ceaf2c747ae667e2492bfb52f4280_amadey_blackenergy_elex_emotet_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop

.exe 11.2MB

2026-06-29_b88ceaf2c747ae667e2492bfb52f4280_amadey_blackenergy_elex_emotet_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_stop

SHA256 9f8e8e3887499f31f12a6f55a7a0241c76392ea6ccc4fdf42eecde10dde78638
MD5 b88ceaf2c747ae667e2492bfb52f4280
SHA1 95cb4edee6b10bf25f0846abbd05f792a4373f11
SHA512 2b7ff04e293bb8855c3520a26305304eed654657ab2de97ddc862b1411250b051fcd96df8a9bc1684786bd65573c5595b2cc7d17d27e5361a092af03c27a60c8
SSDEEP 196608:EGBfWtpGBfWtaTfTeGZF6bUpMBF1p/kjRm4OWi2bm:FWUWsjIbUwF1VERmj2bm
TLSH
T1E4C6D01273F48136F0BB563E84B156789B767C269F36C64F3144A95E5EB3B82C922323
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Futurax
Detects executables containing URLs to raw contents of a Github gist
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables packed with MEW
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths