General
- Target 2026-07-02_e3f62bf06c11abb83ff97173730442ac_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar
- Size 3.4MB
- Sample260702-xza97sc141
- SHA256 a6a47b8b5d0e90557b2c787e5e83cf4981485f623e6703a5c60344833ec13623
- MD5 e3f62bf06c11abb83ff97173730442ac
- SHA1 4e69ef8330b903ac10a078eb29edaf92bf8514a2
- SHA512 4c9ef7ea9e374df49996e231c1c1d4f552c0c404a91b69f9146c4f65defd9d72a03a0c71a39173b04a4c79d680e0e570530b32021293da324ab5c4e8d063ed20
- SSDEEP 49152:XTgUM9dsTh7IwEAPji0AjzVBXdcHTgUM9dsTh7IwEAPji0AjzVBXdc5x2:XM67IwE+jobd+M67IwE+jobdCx2
- TLSH T1F9F57C16F6B442B1D073C179C9E2975AEA7238460730C6CF4399D7692F27BE18A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-02_e3f62bf06c11abb83ff97173730442ac_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_e3f62bf06c11abb83ff97173730442ac_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar
- Size 3.4MB
- SHA256 a6a47b8b5d0e90557b2c787e5e83cf4981485f623e6703a5c60344833ec13623
- MD5 e3f62bf06c11abb83ff97173730442ac
- SHA1 4e69ef8330b903ac10a078eb29edaf92bf8514a2
- SHA512 4c9ef7ea9e374df49996e231c1c1d4f552c0c404a91b69f9146c4f65defd9d72a03a0c71a39173b04a4c79d680e0e570530b32021293da324ab5c4e8d063ed20
- SSDEEP 49152:XTgUM9dsTh7IwEAPji0AjzVBXdcHTgUM9dsTh7IwEAPji0AjzVBXdc5x2:XM67IwE+jobd+M67IwE+jobdCx2
- TLSH T1F9F57C16F6B442B1D073C179C9E2975AEA7238460730C6CF4399D7692F27BE18A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1