General
- Target 2026-06-30_aea367aab02295739b00cad98f5e589c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 14.4MB
- Sample260701-dv23ksdv3p
- SHA256 3719ef1d430d98280380df6f3393aebf936533b651f894fada388698b4d7a3f1
- MD5 aea367aab02295739b00cad98f5e589c
- SHA1 6f64c333bfd145c462c38fbc00d6a3bcb11af602
- SHA512 48be15c3961153641a1d9195ba3b273b4c882c0fec5e6006eda8c3e5ad628e91b22a5bbfe71257d2e371b87ea2c0267042252db7c98efab81b462e8c96404e87
- SSDEEP 196608:Qdn2S9+ULdNpcIa6QHteGZF6bUpMBF1p/kjRm4OWi2bfPdb:E2SlLdNqIQHhIbUwF1VERmj2bl
- TLSH T11BE6BF22F6B48232D076C076CE969665FAB13C554BB08BD71345B39C2F336D2BA36325
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-06-30_aea367aab02295739b00cad98f5e589c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-30_aea367aab02295739b00cad98f5e589c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 14.4MB
- SHA256 3719ef1d430d98280380df6f3393aebf936533b651f894fada388698b4d7a3f1
- MD5 aea367aab02295739b00cad98f5e589c
- SHA1 6f64c333bfd145c462c38fbc00d6a3bcb11af602
- SHA512 48be15c3961153641a1d9195ba3b273b4c882c0fec5e6006eda8c3e5ad628e91b22a5bbfe71257d2e371b87ea2c0267042252db7c98efab81b462e8c96404e87
- SSDEEP 196608:Qdn2S9+ULdNpcIa6QHteGZF6bUpMBF1p/kjRm4OWi2bfPdb:E2SlLdNqIQHhIbUwF1VERmj2bl
- TLSH T11BE6BF22F6B48232D076C076CE969665FAB13C554BB08BD71345B39C2F336D2BA36325
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1