General
- Target 2026-07-14_e3bcd025b89000133f265c836dfc90b7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 14.8MB
- Sample260714-3cy1msft4q
- SHA256 8b9d572875a911717e65e0b35da953d2da94f968a3cfe418f48ec3becf2eaa11
- MD5 e3bcd025b89000133f265c836dfc90b7
- SHA1 44cc226228e7fd5bd541e352cdebb9df35351a90
- SHA512 1926bd5c2fc917939626e3b0db950cb8444fc521c388f3de3b310ae7a0f71a9a3c434db4ecc8e7ee7875929eb428e67a24c016e949e43abc1a12dd254b6135e4
- SSDEEP 196608:Qdn2S9+ULdNpcIa6QHteGZF6bUpMBF1p/kjRm4OWi2bfPdr6a:E2SlLdNqIQHhIbUwF1VERmj2boa
- TLSH T17FF6BF22F6B48232D077C076CAD69655EAB13C554BB08BC71345B3AC2F336D2BA36725
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-14_e3bcd025b89000133f265c836dfc90b7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_e3bcd025b89000133f265c836dfc90b7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 14.8MB
- SHA256 8b9d572875a911717e65e0b35da953d2da94f968a3cfe418f48ec3becf2eaa11
- MD5 e3bcd025b89000133f265c836dfc90b7
- SHA1 44cc226228e7fd5bd541e352cdebb9df35351a90
- SHA512 1926bd5c2fc917939626e3b0db950cb8444fc521c388f3de3b310ae7a0f71a9a3c434db4ecc8e7ee7875929eb428e67a24c016e949e43abc1a12dd254b6135e4
- SSDEEP 196608:Qdn2S9+ULdNpcIa6QHteGZF6bUpMBF1p/kjRm4OWi2bfPdr6a:E2SlLdNqIQHhIbUwF1VERmj2boa
- TLSH T17FF6BF22F6B48232D077C076CAD69655EAB13C554BB08BC71345B3AC2F336D2BA36725
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1