General
- Target 2026-07-14_1a2911d9bab7590675bb694f64e609a9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 14.4MB
- Sample260714-vx2chacs9x
- SHA256 48c7f97675f3d217f0a5588e277bb722fc238739a1fc43edd288dec66d90a78e
- MD5 1a2911d9bab7590675bb694f64e609a9
- SHA1 4ec5d0a33ba13336f007f72337678f60c2213721
- SHA512 64b8cda6f19574f5a416b6724b79aa6f2ee4f9f21b9b4bf946a796ef6d5951393453c9b657a339711a001f13f14f1bb6c280bfa1e686bc04bee2cd1ac7f41880
- SSDEEP 196608:Qdn2S9+ULdNpcIa6QHteGZF6bUpMBF1p/kjRm4OWi2bfPdv:E2SlLdNqIQHhIbUwF1VERmj2bp
- TLSH T158E6BF22F6B48232D076C076CE969665FAB13C554BB08BD71345B39C2F336D2BA36325
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-14_1a2911d9bab7590675bb694f64e609a9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_1a2911d9bab7590675bb694f64e609a9_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 14.4MB
- SHA256 48c7f97675f3d217f0a5588e277bb722fc238739a1fc43edd288dec66d90a78e
- MD5 1a2911d9bab7590675bb694f64e609a9
- SHA1 4ec5d0a33ba13336f007f72337678f60c2213721
- SHA512 64b8cda6f19574f5a416b6724b79aa6f2ee4f9f21b9b4bf946a796ef6d5951393453c9b657a339711a001f13f14f1bb6c280bfa1e686bc04bee2cd1ac7f41880
- SSDEEP 196608:Qdn2S9+ULdNpcIa6QHteGZF6bUpMBF1p/kjRm4OWi2bfPdv:E2SlLdNqIQHhIbUwF1VERmj2bp
- TLSH T158E6BF22F6B48232D076C076CE969665FAB13C554BB08BD71345B39C2F336D2BA36325
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1