General
- Target 2026-07-06_04fa3d171c0a4e9b8a308e097c9dbbd5_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_njrat_smoke-loader_stealc_vidar
- Size 11.4MB
- Sample260707-getm2say8t
- SHA256 4dac44c56ccfe7908a45ece538f82791aa6127f3a0d570ad35ac3fd712c951f4
- MD5 04fa3d171c0a4e9b8a308e097c9dbbd5
- SHA1 839ef4285f0b102222d14a49e213033cba1e448c
- SHA512 f5663ae54582c07834419e0dbc81a92a4181523d16f08954c670749e4145c54b99527cda21000b60b58ea0052c050c3655f80ce6aabf2a7941488040ea07488c
- SSDEEP 98304:XMca335GjnMca334bKUgTH2M2m9Uz0oAaldmdmnpPfkZcTdfkZcnjo9KRuy5aQ:2IaYgTH2qTKmd0tPTZPjo9qR
- TLSH T1BEC66C12B569417DD067D074CA8BDA26EE313C8A0770A8EF1284B6B43E77AF17B39315
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-06_04fa3d171c0a4e9b8a308e097c9dbbd5_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-06_04fa3d171c0a4e9b8a308e097c9dbbd5_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_njrat_smoke-loader_stealc_vidar
- Size 11.4MB
- SHA256 4dac44c56ccfe7908a45ece538f82791aa6127f3a0d570ad35ac3fd712c951f4
- MD5 04fa3d171c0a4e9b8a308e097c9dbbd5
- SHA1 839ef4285f0b102222d14a49e213033cba1e448c
- SHA512 f5663ae54582c07834419e0dbc81a92a4181523d16f08954c670749e4145c54b99527cda21000b60b58ea0052c050c3655f80ce6aabf2a7941488040ea07488c
- SSDEEP 98304:XMca335GjnMca334bKUgTH2M2m9Uz0oAaldmdmnpPfkZcTdfkZcnjo9KRuy5aQ:2IaYgTH2qTKmd0tPTZPjo9qR
- TLSH T1BEC66C12B569417DD067D074CA8BDA26EE313C8A0770A8EF1284B6B43E77AF17B39315
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1