General
- Target 2026-07-12_01a98838b5301f72e88f469d9b3d6603_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar
- Size 14.5MB
- Sample260712-r8d5kab14j
- SHA256 e2567211f268b9fc7475e43f0968829d8909d29c4b90cfefe4540673339a0676
- MD5 01a98838b5301f72e88f469d9b3d6603
- SHA1 c7920d87022bd08d904224e2dc791c7d0ba777e9
- SHA512 e2fd83c5e91c7e2b3093e556ffc85357a8171534b54b20b686062eafd75c4f51d31da6b629820afc6d435f5a12171d59887d9e5ff479fcf98c78c772af10cbbb
- SSDEEP 196608:5Kmd0ZdYJEul4szEonqtHdxWyZ/K0ttYVAAT9qyov:gqpqFaEon9yZ/K0ttYZTYlv
- TLSH T1D3E69D23B59580B8E166D074CE69AB71C769BC294BF154DF32807BE91E326C13F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-12_01a98838b5301f72e88f469d9b3d6603_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-12_01a98838b5301f72e88f469d9b3d6603_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar
- Size 14.5MB
- SHA256 e2567211f268b9fc7475e43f0968829d8909d29c4b90cfefe4540673339a0676
- MD5 01a98838b5301f72e88f469d9b3d6603
- SHA1 c7920d87022bd08d904224e2dc791c7d0ba777e9
- SHA512 e2fd83c5e91c7e2b3093e556ffc85357a8171534b54b20b686062eafd75c4f51d31da6b629820afc6d435f5a12171d59887d9e5ff479fcf98c78c772af10cbbb
- SSDEEP 196608:5Kmd0ZdYJEul4szEonqtHdxWyZ/K0ttYVAAT9qyov:gqpqFaEon9yZ/K0ttYZTYlv
- TLSH T1D3E69D23B59580B8E166D074CE69AB71C769BC294BF154DF32807BE91E326C13F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1