General
- Target 2026-07-21_7adac4beebfbcef462a2f5ed8015bfe9_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry
- Size 4.4MB
- Sample260721-qpca7ack6y
- SHA256 da488293e1faa16cc951b789af1587da7a08e93830c5b4bd2fc1437d5f86ce0b
- MD5 7adac4beebfbcef462a2f5ed8015bfe9
- SHA1 e2a5eb51844662aaa2d9fded75d21942ddf7a7c0
- SHA512 7ff63a2c97b8e0c58569f7a2dc58705a17443a5a002e01710cdf662a448dee52a905a94a06c0a512a5d9070a0ccddba2f55e64797d376a4b3283f6e116e81275
- SSDEEP 49152:VQPji0AjkVBXdc4+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyDeW4SkZr:VujoQds0oAaldmdmnpDfkZcc
- TLSH T17F267D03F16446A6D066C078CE82D665EB323C4947F195EF2284B7E92E37BD17B3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-21_7adac4beebfbcef462a2f5ed8015bfe9_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-21_7adac4beebfbcef462a2f5ed8015bfe9_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry
- Size 4.4MB
- SHA256 da488293e1faa16cc951b789af1587da7a08e93830c5b4bd2fc1437d5f86ce0b
- MD5 7adac4beebfbcef462a2f5ed8015bfe9
- SHA1 e2a5eb51844662aaa2d9fded75d21942ddf7a7c0
- SHA512 7ff63a2c97b8e0c58569f7a2dc58705a17443a5a002e01710cdf662a448dee52a905a94a06c0a512a5d9070a0ccddba2f55e64797d376a4b3283f6e116e81275
- SSDEEP 49152:VQPji0AjkVBXdc4+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyDeW4SkZr:VujoQds0oAaldmdmnpDfkZcc
- TLSH T17F267D03F16446A6D066C078CE82D665EB323C4947F195EF2284B7E92E37BD17B3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1