General
- Target 2026-07-14_587836e2b36bec0ee7b72d0f25bb961f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 14.8MB
- Sample260714-16d68aex3l
- SHA256 08b1043c78d55de2627b3c9b0d28de223f5e58221470c2f91b85bc854af78494
- MD5 587836e2b36bec0ee7b72d0f25bb961f
- SHA1 8211eb1093e5bc4da89624a43f236503d95feaa9
- SHA512 78572f08f95f6ea406919d410000542d218fb04953f1e666fa42d28873419bf7649eceffdc83fea963032cd6184c37fe0b92ec772b75a957daed1f8fabe6e023
- SSDEEP 196608:Qdn2S9+ULdNpcIa6QHteGZF6bUpMBF1p/kjRm4OWi2bfPdedv:E2SlLdNqIQHhIbUwF1VERmj2bI
- TLSH T1B7F6BF22F6B44232D077C076CE969665EAB23C554BB087C71345B3AC2F336D2BA36725
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-14_587836e2b36bec0ee7b72d0f25bb961f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_587836e2b36bec0ee7b72d0f25bb961f_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 14.8MB
- SHA256 08b1043c78d55de2627b3c9b0d28de223f5e58221470c2f91b85bc854af78494
- MD5 587836e2b36bec0ee7b72d0f25bb961f
- SHA1 8211eb1093e5bc4da89624a43f236503d95feaa9
- SHA512 78572f08f95f6ea406919d410000542d218fb04953f1e666fa42d28873419bf7649eceffdc83fea963032cd6184c37fe0b92ec772b75a957daed1f8fabe6e023
- SSDEEP 196608:Qdn2S9+ULdNpcIa6QHteGZF6bUpMBF1p/kjRm4OWi2bfPdedv:E2SlLdNqIQHhIbUwF1VERmj2bI
- TLSH T1B7F6BF22F6B44232D077C076CE969665EAB23C554BB087C71345B3AC2F336D2BA36725
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1