General
- Target 2026-07-11_df8f5fc568a5298bf851d719f353af59_amadey_blackenergy_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_rhadamanthys_smoke-loader_stop_vidar
- Size 10.5MB
- Sample260711-sdq2bads5r
- SHA256 d86a0bb255138fe3669041d3dbdb9da311fba4b01c8a21ca419bf213e8f1daaf
- MD5 df8f5fc568a5298bf851d719f353af59
- SHA1 c4d8002a89b9b38ce5401f4d072cf8729c472cc3
- SHA512 724faf617b6375cea0e3c8ac4d67c2b43e569888fddc7dfa7dbb5dfc5be4d1b7db0918a0477654a4f48146f2941f76a99b2b4f7034592d15a744239b522f6b90
- SSDEEP 196608:XGBfWAa/I+mhS1qfPKmd0ddodCdgoyoKqU6L:sWASI+PQfyqglzjL
- TLSH T1EAB68D02B29445B5D0B7D134C9A29635EB727C450BB196DF2384F6E92E33BD0BE36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-11_df8f5fc568a5298bf851d719f353af59_amadey_blackenergy_cobalt-strike_elex_emotet_glassworm_h.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-11_df8f5fc568a5298bf851d719f353af59_amadey_blackenergy_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_rhadamanthys_smoke-loader_stop_vidar
- Size 10.5MB
- SHA256 d86a0bb255138fe3669041d3dbdb9da311fba4b01c8a21ca419bf213e8f1daaf
- MD5 df8f5fc568a5298bf851d719f353af59
- SHA1 c4d8002a89b9b38ce5401f4d072cf8729c472cc3
- SHA512 724faf617b6375cea0e3c8ac4d67c2b43e569888fddc7dfa7dbb5dfc5be4d1b7db0918a0477654a4f48146f2941f76a99b2b4f7034592d15a744239b522f6b90
- SSDEEP 196608:XGBfWAa/I+mhS1qfPKmd0ddodCdgoyoKqU6L:sWASI+PQfyqglzjL
- TLSH T1EAB68D02B29445B5D0B7D134C9A29635EB727C450BB196DF2384F6E92E33BD0BE36722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1