General
- Target 2026-07-15_37ff5e67f9b73cba00693cc2d37dbb4e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar
- Size 13.6MB
- Sample260715-mcskvsds4v
- SHA256 3fb99c6d4be7e878851c8a2aa508d2ccd1f4af8ad268c7a5fc6f3c101b748fff
- MD5 37ff5e67f9b73cba00693cc2d37dbb4e
- SHA1 d5232e19161ddb32e0bf13fb12db6651cc83aeef
- SHA512 2cc5a3574f7fc85bccb3cc7876b512a4a6433def5104d67c0e2990b125bce4b06455cecf431da94cdf7834a19cb5370c85ec55cf8963320905ab3cb763f61703
- SSDEEP 196608:5Kmd0ZdYJEul4szEonqtHdxWyZ/K0ttYVAAT0os:gqpqFaEon9yZ/K0ttYZTLs
- TLSH T16CE69D23B99580A8E166C074CEA5AB71C765BC294BF154DF32807BE91E327D13F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-15_37ff5e67f9b73cba00693cc2d37dbb4e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloade.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-15_37ff5e67f9b73cba00693cc2d37dbb4e_amadey_cobalt-strike_coinminer_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_vidar
- Size 13.6MB
- SHA256 3fb99c6d4be7e878851c8a2aa508d2ccd1f4af8ad268c7a5fc6f3c101b748fff
- MD5 37ff5e67f9b73cba00693cc2d37dbb4e
- SHA1 d5232e19161ddb32e0bf13fb12db6651cc83aeef
- SHA512 2cc5a3574f7fc85bccb3cc7876b512a4a6433def5104d67c0e2990b125bce4b06455cecf431da94cdf7834a19cb5370c85ec55cf8963320905ab3cb763f61703
- SSDEEP 196608:5Kmd0ZdYJEul4szEonqtHdxWyZ/K0ttYVAAT0os:gqpqFaEon9yZ/K0ttYZTLs
- TLSH T16CE69D23B99580A8E166C074CEA5AB71C765BC294BF154DF32807BE91E327D13F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1