General
- Target 2026-07-15_5c1587360e326e7d946a5c0fad746c7c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 14.4MB
- Sample260715-dbhjtsas7j
- SHA256 2f588c090ac97c59d80a74190c7d6c4bf76ce254b13c86c5a3a7d3d35ad4fb55
- MD5 5c1587360e326e7d946a5c0fad746c7c
- SHA1 ffefc25c6cc386174f63c758e1a3c11fed31dd40
- SHA512 a7a4d017d9dfdd332e02da7b927a7833524177b91e17d017f33f2311224223b0a6e6db47c26061b3b469b68c1c8099bf50bcc5fe295f7c987b967c7efb93376e
- SSDEEP 196608:Qdn2S9+ULdNpcIa6QHteGZF6bUpMBF1p/kjRm4OWi2bfPdD:E2SlLdNqIQHhIbUwF1VERmj2bV
- TLSH T1BCE6BF22F6B48232D076C076CE969665FAB13C554BB08BD71345B39C2F336D2BA36325
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-15_5c1587360e326e7d946a5c0fad746c7c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-15_5c1587360e326e7d946a5c0fad746c7c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 14.4MB
- SHA256 2f588c090ac97c59d80a74190c7d6c4bf76ce254b13c86c5a3a7d3d35ad4fb55
- MD5 5c1587360e326e7d946a5c0fad746c7c
- SHA1 ffefc25c6cc386174f63c758e1a3c11fed31dd40
- SHA512 a7a4d017d9dfdd332e02da7b927a7833524177b91e17d017f33f2311224223b0a6e6db47c26061b3b469b68c1c8099bf50bcc5fe295f7c987b967c7efb93376e
- SSDEEP 196608:Qdn2S9+ULdNpcIa6QHteGZF6bUpMBF1p/kjRm4OWi2bfPdD:E2SlLdNqIQHhIbUwF1VERmj2bV
- TLSH T1BCE6BF22F6B48232D076C076CE969665FAB13C554BB08BD71345B39C2F336D2BA36325
- MD5 SHA1 SHA512 SSDEEP TLSH
Detects Futurax
- Custom signature
Detects executables packed with MEW
Adds Run key to start application
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1