General
- Target 2026-07-17_873ee77a5acd2a40315b05908f44b818_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 14.4MB
- Sample260718-dkpdqshx5y
- SHA256 9667a16b503e0a4123e22f41f591e01a37a98366ce2f47158ff3f1e2fe65e917
- MD5 873ee77a5acd2a40315b05908f44b818
- SHA1 f641cf0508752aa3dc566b4d42fd80703fa0b517
- SHA512 24857a458d4e573ebad49775a713f740acdfaa3d0b05bf343af16dc1f3067e71d5ed17c36bb522d430421ffd3bd3c7595626608d7c26f9de0f0ee206543e06ee
- SSDEEP 196608:C4ogcIyoA2HKmd0BSeGZF6bUpMBF1p/kjRm4OWi2bXox:aNCsqbIbUwF1VERmj2b4x
- TLSH T19AE6CF12F1A442A5D066C075CF92D625EBB13C594BF086EB3285B7ED2F336D07A3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-17_873ee77a5acd2a40315b05908f44b818_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-17_873ee77a5acd2a40315b05908f44b818_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 14.4MB
- SHA256 9667a16b503e0a4123e22f41f591e01a37a98366ce2f47158ff3f1e2fe65e917
- MD5 873ee77a5acd2a40315b05908f44b818
- SHA1 f641cf0508752aa3dc566b4d42fd80703fa0b517
- SHA512 24857a458d4e573ebad49775a713f740acdfaa3d0b05bf343af16dc1f3067e71d5ed17c36bb522d430421ffd3bd3c7595626608d7c26f9de0f0ee206543e06ee
- SSDEEP 196608:C4ogcIyoA2HKmd0BSeGZF6bUpMBF1p/kjRm4OWi2bXox:aNCsqbIbUwF1VERmj2b4x
- TLSH T19AE6CF12F1A442A5D066C075CF92D625EBB13C594BF086EB3285B7ED2F336D07A3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1