General
- Target 2026-07-18_5395a79ae2e5c07792982cbeadc8dccc_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 15.4MB
- Sample260718-nfenvahx3m
- SHA256 77bedef7f046a07ca1d56cf6ec68dfb54a6143b15c9e0b7632e0150bbb2c8dad
- MD5 5395a79ae2e5c07792982cbeadc8dccc
- SHA1 b752b8fce0b1a6c507e581d5d65e310109d1774b
- SHA512 b376066d05b74e18e92af04e61a5063e71ed9f06d65310290add50127485bcd446b61969a7af6a4dcb60379839779dbed60dcf39ec52ebc81465ca08e4605d4d
- SSDEEP 196608:Qdn2S9+ULdNpcIa6QHteGZF6bUpMBF1p/kjRm4OWi2bfPdr6qoT:E2SlLdNqIQHhIbUwF1VERmj2bo9T
- TLSH T11EF6BF22F6B48232D077C076CAD2A655FA713C554BB08BC71345A7AC2F336D2BA36725
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-18_5395a79ae2e5c07792982cbeadc8dccc_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-18_5395a79ae2e5c07792982cbeadc8dccc_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 15.4MB
- SHA256 77bedef7f046a07ca1d56cf6ec68dfb54a6143b15c9e0b7632e0150bbb2c8dad
- MD5 5395a79ae2e5c07792982cbeadc8dccc
- SHA1 b752b8fce0b1a6c507e581d5d65e310109d1774b
- SHA512 b376066d05b74e18e92af04e61a5063e71ed9f06d65310290add50127485bcd446b61969a7af6a4dcb60379839779dbed60dcf39ec52ebc81465ca08e4605d4d
- SSDEEP 196608:Qdn2S9+ULdNpcIa6QHteGZF6bUpMBF1p/kjRm4OWi2bfPdr6qoT:E2SlLdNqIQHhIbUwF1VERmj2bo9T
- TLSH T11EF6BF22F6B48232D077C076CAD2A655FA713C554BB08BC71345A7AC2F336D2BA36725
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1