General
- Target 2026-07-15_a3f0d0094ad3b98eacb2c37429dbdcf5_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
- Size 8.0MB
- Sample260715-e4se6sbw8n
- SHA256 90c197334c3acdd69c31f465c5762450161719574ead4a07184ca5fb64feb7bc
- MD5 a3f0d0094ad3b98eacb2c37429dbdcf5
- SHA1 52c0281944ab6381d21a016c99ffe64a0e163bce
- SHA512 8a61ec61735d4c46dd8f1ae34d9e1c9080809c20ddb296df55fd195cf9200bc928129f59dd1ecb198446a79b1e192f00081d79a5c951a78f78a01de0596a440c
- SSDEEP 98304:XMca335GOs0oAaldmdmnpW0oAaldmdmnp2KRuy5aY6e:2IcKmd0NKmd0wqr6e
- TLSH T1DA867B03A2A444A9D156D134CE4AD236EB367C594BF165FF3280BAD93E33AD07B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-15_a3f0d0094ad3b98eacb2c37429dbdcf5_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-15_a3f0d0094ad3b98eacb2c37429dbdcf5_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
- Size 8.0MB
- SHA256 90c197334c3acdd69c31f465c5762450161719574ead4a07184ca5fb64feb7bc
- MD5 a3f0d0094ad3b98eacb2c37429dbdcf5
- SHA1 52c0281944ab6381d21a016c99ffe64a0e163bce
- SHA512 8a61ec61735d4c46dd8f1ae34d9e1c9080809c20ddb296df55fd195cf9200bc928129f59dd1ecb198446a79b1e192f00081d79a5c951a78f78a01de0596a440c
- SSDEEP 98304:XMca335GOs0oAaldmdmnpW0oAaldmdmnp2KRuy5aY6e:2IcKmd0NKmd0wqr6e
- TLSH T1DA867B03A2A444A9D156D134CE4AD236EB367C594BF165FF3280BAD93E33AD07B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1