General
- Target 2026-07-22_1867682962e3a29b57afceebc0e1cb11_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
- Size 10.9MB
- Sample260722-ws9zhs1enh
- SHA256 3f41f69c7e5609d22384de02b0144925b992fda1fcad6028acfeba7041f92be8
- MD5 1867682962e3a29b57afceebc0e1cb11
- SHA1 2f35ffb3fb7dfacb4901aaad164fa0db8f70fc17
- SHA512 7d8efc951cae608b31a9d530661aaeff67cd1870a357b78e523659922929b8163174c2841e2a203f9ec4860e3481555b8495e0f7abfadd82828ded3c128b6635
- SSDEEP 98304:XMca335GOshV1LapIRfkZcA6wMca335GOshV1LapIRfkZud3:2IpV1cI9PA6BIpV1cI9rd3
- TLSH T11BB68D22B1B54162D066C075CF869725EBB13C558FF087EB6245B3D82F33AD0BA39726
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-22_1867682962e3a29b57afceebc0e1cb11_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_smok.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-22_1867682962e3a29b57afceebc0e1cb11_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
- Size 10.9MB
- SHA256 3f41f69c7e5609d22384de02b0144925b992fda1fcad6028acfeba7041f92be8
- MD5 1867682962e3a29b57afceebc0e1cb11
- SHA1 2f35ffb3fb7dfacb4901aaad164fa0db8f70fc17
- SHA512 7d8efc951cae608b31a9d530661aaeff67cd1870a357b78e523659922929b8163174c2841e2a203f9ec4860e3481555b8495e0f7abfadd82828ded3c128b6635
- SSDEEP 98304:XMca335GOshV1LapIRfkZcA6wMca335GOshV1LapIRfkZud3:2IpV1cI9PA6BIpV1cI9rd3
- TLSH T11BB68D22B1B54162D066C075CF869725EBB13C558FF087EB6245B3D82F33AD0BA39726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1