General
- Target 2026-07-06_4ad7b6844d5d117afa1f5fdd33bf6632_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar_wannacry
- Size 9.1MB
- Sample260706-wxmpsabv2v
- SHA256 c5b813c2acc37d944336a6596e6929b1ebb551fd2390b56f7f90b77291dd2606
- MD5 4ad7b6844d5d117afa1f5fdd33bf6632
- SHA1 f9f10eadbde4719ad326c0df75258233783a8d25
- SHA512 a82792e0e5fd466460bb483d1b1f97ddb60fc9443761194e7737ca62a5775499ce89fd7afa9b14f7d23791bcfe0119b1fec4f992a193614d20665652e71324b2
- SSDEEP 98304:UucmoEV2VjnSdVyucF2UhLapIrjoTkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0Eb:YEV2VLSdVm2ccIfonJEul4szEonqtu65
- TLSH T174A68D31B992C175D2524070CF99AFB5C2A8BC354BF145C77680BBEA5E722C27E31B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-06_4ad7b6844d5d117afa1f5fdd33bf6632_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-06_4ad7b6844d5d117afa1f5fdd33bf6632_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar_wannacry
- Size 9.1MB
- SHA256 c5b813c2acc37d944336a6596e6929b1ebb551fd2390b56f7f90b77291dd2606
- MD5 4ad7b6844d5d117afa1f5fdd33bf6632
- SHA1 f9f10eadbde4719ad326c0df75258233783a8d25
- SHA512 a82792e0e5fd466460bb483d1b1f97ddb60fc9443761194e7737ca62a5775499ce89fd7afa9b14f7d23791bcfe0119b1fec4f992a193614d20665652e71324b2
- SSDEEP 98304:UucmoEV2VjnSdVyucF2UhLapIrjoTkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0Eb:YEV2VLSdVm2ccIfonJEul4szEonqtu65
- TLSH T174A68D31B992C175D2524070CF99AFB5C2A8BC354BF145C77680BBEA5E722C27E31B26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1