General
- Target 2026-07-14_76a8caea86a8070ef591842b679cfa88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 15.3MB
- Sample260714-1xtwbaev7n
- SHA256 a65402fff7e9861482a9470eb09f6808bb65fc9e7b1fadf63ffa7637e7727701
- MD5 76a8caea86a8070ef591842b679cfa88
- SHA1 be4f2a3f6b3a2c8a1313a2bb74a662d2008cb7ae
- SHA512 2fd1c509419c54a2080746ed4655034cb0ff7834ffa5014d7ad607fb4ccc5d637241a2955ced6a42e796e9593d78e3f786334b56f78fbeb6663006977e585cb7
- SSDEEP 196608:Qdn2S9+ULdNpcIa6QHteGZF6bUpMBF1p/kjRm4OWi2bfPdYqi:E2SlLdNqIQHhIbUwF1VERmj2bzi
- TLSH T116F6CF22F6B44232D076D072CA96A765FAB13C554BB087C71345B7AC2F336D2BA36325
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-14_76a8caea86a8070ef591842b679cfa88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_76a8caea86a8070ef591842b679cfa88_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 15.3MB
- SHA256 a65402fff7e9861482a9470eb09f6808bb65fc9e7b1fadf63ffa7637e7727701
- MD5 76a8caea86a8070ef591842b679cfa88
- SHA1 be4f2a3f6b3a2c8a1313a2bb74a662d2008cb7ae
- SHA512 2fd1c509419c54a2080746ed4655034cb0ff7834ffa5014d7ad607fb4ccc5d637241a2955ced6a42e796e9593d78e3f786334b56f78fbeb6663006977e585cb7
- SSDEEP 196608:Qdn2S9+ULdNpcIa6QHteGZF6bUpMBF1p/kjRm4OWi2bfPdYqi:E2SlLdNqIQHhIbUwF1VERmj2bzi
- TLSH T116F6CF22F6B44232D076D072CA96A765FAB13C554BB087C71345B7AC2F336D2BA36325
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1