futurax | 2026-07-10_a6b25ff7ce04ea4156fa3ef8e7691cba_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_a6b25ff7ce04ea4156fa3ef8e7691cba_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry
Size 11.9MB
Sample260710-v2zdpsdv8j
SHA256 110e53bf7fc423f0bc8e72f10ebbda1cbbb5349bea348edbd556b96675ab1885
MD5 a6b25ff7ce04ea4156fa3ef8e7691cba
SHA1 657c4e820798aecebb3b7249b03cb911e9cc01ae
SHA512 399dd60bfca3f44931a0396c3c88455e04a02c4e6fe3088aa96838a81ef799657d3581a0fddfd1b7de3c026140f7e90a7f55a256286bdb607253a5ba7c7e207a
SSDEEP 196608:ski9XwgwAMtPdf5P7qAdacItKmd0FTfgP5:j+Ajxh5OO7qQ+
TLSH
T10CC69D13B2E40466E1AAD139CE629635A7B17C294BF1D2DF3240B6D91E737C07A3A713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm futurax

Malware Config

Signatures

Family: Futurax
Futurax is a Windows worm written in Delphi.
worm futurax

Detects Futurax 1 IoCs

resource	yara_rule
sample	family_futurax

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables packed with MEW 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_MEW

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_a6b25ff7ce04ea4156fa3ef8e7691cba_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry

File Explorer

2026-07-10_a6b25ff7ce04ea4156fa3ef8e7691cba_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry

.exe 11.9MB

2026-07-10_a6b25ff7ce04ea4156fa3ef8e7691cba_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry

SHA256 110e53bf7fc423f0bc8e72f10ebbda1cbbb5349bea348edbd556b96675ab1885
MD5 a6b25ff7ce04ea4156fa3ef8e7691cba
SHA1 657c4e820798aecebb3b7249b03cb911e9cc01ae
SHA512 399dd60bfca3f44931a0396c3c88455e04a02c4e6fe3088aa96838a81ef799657d3581a0fddfd1b7de3c026140f7e90a7f55a256286bdb607253a5ba7c7e207a
SSDEEP 196608:ski9XwgwAMtPdf5P7qAdacItKmd0FTfgP5:j+Ajxh5OO7qQ+
TLSH
T10CC69D13B2E40466E1AAD139CE629635A7B17C294BF1D2DF3240B6D91E737C07A3A713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Futurax
Detects executables containing URLs to raw contents of a Github gist
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables packed with MEW
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths