General
- Target 2026-07-18_fd140c496d3a0c6da0a6168ff790a36e_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar_wannacry
- Size 13.8MB
- Sample260718-l2akxaaz3z
- SHA256 3a48c30d288b6b4745437a6c96e9df592eeda859c8dc7fe4112350b4f9a662d1
- MD5 fd140c496d3a0c6da0a6168ff790a36e
- SHA1 c80b122dacda5aa9aced66fb05ff4828ffcd868d
- SHA512 85ea38c68a5eb5bdbc77defe8c7cb9bd41d2ead45f0b9c95f1f0133269ed54d4be489140e7fab05003868ec7aa11e5db31fafbd1fb4379d83c5e4e011f71e5f4
- SSDEEP 196608:62S9+ULdNPtbuPZOOmnqogHh/mPhqR6xWyZ/K0ttYVAATjoz:62SlLdNPt6ROOmqZxQMyZ/K0ttYZTMz
- TLSH T1E1E6BF1BF7A44176E066D175CA659321EB32FC5587B09ACF234473A82F32AD27B35322
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-18_fd140c496d3a0c6da0a6168ff790a36e_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-18_fd140c496d3a0c6da0a6168ff790a36e_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar_wannacry
- Size 13.8MB
- SHA256 3a48c30d288b6b4745437a6c96e9df592eeda859c8dc7fe4112350b4f9a662d1
- MD5 fd140c496d3a0c6da0a6168ff790a36e
- SHA1 c80b122dacda5aa9aced66fb05ff4828ffcd868d
- SHA512 85ea38c68a5eb5bdbc77defe8c7cb9bd41d2ead45f0b9c95f1f0133269ed54d4be489140e7fab05003868ec7aa11e5db31fafbd1fb4379d83c5e4e011f71e5f4
- SSDEEP 196608:62S9+ULdNPtbuPZOOmnqogHh/mPhqR6xWyZ/K0ttYVAATjoz:62SlLdNPt6ROOmqZxQMyZ/K0ttYZTMz
- TLSH T1E1E6BF1BF7A44176E066D175CA659321EB32FC5587B09ACF234473A82F32AD27B35322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1