General
- Target 2026-07-10_a327a065f9f5fd41fc452247a7572a34_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar_wannacry
- Size 15.6MB
- Sample260710-v3m23adv9n
- SHA256 f79804a5b4312ce8f234b681d530e44046717e026e5f05ff1add79d554852493
- MD5 a327a065f9f5fd41fc452247a7572a34
- SHA1 07ebb8210eea354ab0c9ce70630205dc8e2a2ebc
- SHA512 9967faebce30d0af8080478090ed739770aa77dece865653964fbeea383dcfc21e953d8ead91d0d05dabfaa9585cbebe298d083d6f244e3497489fbf5ec58f74
- SSDEEP 196608:YEV2VLSdVm2S9+ULdNldZmo6PLoCWyZ/K0ttYVAATLojP0E:YU2Odg2SlLdNlhHdyZ/K0ttYZT0d
- TLSH T1BAF68D13F2B842B6D077C175C9A29715EA727C0507709AEF5350B3AC2E37AE1AA39731
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-10_a327a065f9f5fd41fc452247a7572a34_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-10_a327a065f9f5fd41fc452247a7572a34_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_vidar_wannacry
- Size 15.6MB
- SHA256 f79804a5b4312ce8f234b681d530e44046717e026e5f05ff1add79d554852493
- MD5 a327a065f9f5fd41fc452247a7572a34
- SHA1 07ebb8210eea354ab0c9ce70630205dc8e2a2ebc
- SHA512 9967faebce30d0af8080478090ed739770aa77dece865653964fbeea383dcfc21e953d8ead91d0d05dabfaa9585cbebe298d083d6f244e3497489fbf5ec58f74
- SSDEEP 196608:YEV2VLSdVm2S9+ULdNldZmo6PLoCWyZ/K0ttYVAATLojP0E:YU2Odg2SlLdNlhHdyZ/K0ttYZT0d
- TLSH T1BAF68D13F2B842B6D077C175C9A29715EA727C0507709AEF5350B3AC2E37AE1AA39731
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1