General
- Target 2026-07-05_96c865ee14778011079fbcb47edc60af_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar_wannacry
- Size 10.2MB
- Sample260705-tgadeadw6x
- SHA256 9a2bb6e34e0014fcdcae03e834dce98e1e3a3530d1c8b596e1517b0fe3bd21ba
- MD5 96c865ee14778011079fbcb47edc60af
- SHA1 1e7b7359b4e8eb00b0cb242e304beab8ea3d4e57
- SHA512 1023c7e172169185df17399ba0e4ee81866ae1092f128a336915ca95d854f11bac94cb0f9eeb5b112ae6894d45cf9f62d2ef1f2fc6047465e01402bc43ec85db
- SSDEEP 98304:UIyatduIyatdtgPALJTIuLIyatduIyatdtgPALJTIuGF:8QdWQdMALJThNQdWQdMALJThy
- TLSH T12BB66B223180556AF129EF7BC32A7728B9307D6A1EA1C58FEA0D721D19353F25B73346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-05_96c865ee14778011079fbcb47edc60af_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_96c865ee14778011079fbcb47edc60af_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win11ltsc2024-20260629-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-05_96c865ee14778011079fbcb47edc60af_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar_wannacry
- Size 10.2MB
- SHA256 9a2bb6e34e0014fcdcae03e834dce98e1e3a3530d1c8b596e1517b0fe3bd21ba
- MD5 96c865ee14778011079fbcb47edc60af
- SHA1 1e7b7359b4e8eb00b0cb242e304beab8ea3d4e57
- SHA512 1023c7e172169185df17399ba0e4ee81866ae1092f128a336915ca95d854f11bac94cb0f9eeb5b112ae6894d45cf9f62d2ef1f2fc6047465e01402bc43ec85db
- SSDEEP 98304:UIyatduIyatdtgPALJTIuLIyatduIyatdtgPALJTIuGF:8QdWQdMALJThNQdWQdMALJThy
- TLSH T12BB66B223180556AF129EF7BC32A7728B9307D6A1EA1C58FEA0D721D19353F25B73346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1