General
- Target 2026-07-14_ef7718212840efbe87ecfacf9ced7965_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_njrat_smoke-loader_stealc_vidar
- Size 9.3MB
- Sample260714-w1wrvsav2p
- SHA256 35cd9c665cae440be54faa5b8c87cd4f3e6a3f8dd796077052161af5a85e39e8
- MD5 ef7718212840efbe87ecfacf9ced7965
- SHA1 15a71085f978ac11bafe08a716640527ad612168
- SHA512 a8a0472370d06d734aa5304a94d5c0d4be6cfbcc134a8fcdb49005693f3aae29e7b50f6f93d85a942c15736986d093d929d5e0554089e89ab67edc03142db217
- SSDEEP 98304:XMca335GOs0oAaldmdmnpW0oAaldmdmnp2KRuy5aY6RKRuy5asdN:2IcKmd0NKmd0wqr6RqXdN
- TLSH T194A69D03B29444E5D166D130CE4AD235EB767C194BF1A5EF32807AE92E33AD07B39726
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-14_ef7718212840efbe87ecfacf9ced7965_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_ef7718212840efbe87ecfacf9ced7965_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_njrat_smoke-loader_stealc_vidar
- Size 9.3MB
- SHA256 35cd9c665cae440be54faa5b8c87cd4f3e6a3f8dd796077052161af5a85e39e8
- MD5 ef7718212840efbe87ecfacf9ced7965
- SHA1 15a71085f978ac11bafe08a716640527ad612168
- SHA512 a8a0472370d06d734aa5304a94d5c0d4be6cfbcc134a8fcdb49005693f3aae29e7b50f6f93d85a942c15736986d093d929d5e0554089e89ab67edc03142db217
- SSDEEP 98304:XMca335GOs0oAaldmdmnpW0oAaldmdmnp2KRuy5aY6RKRuy5asdN:2IcKmd0NKmd0wqr6RqXdN
- TLSH T194A69D03B29444E5D166D130CE4AD235EB767C194BF1A5EF32807AE92E33AD07B39726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1