General
- Target 2026-07-29_fc9e407f1285a225a9cb49d7ed5db099_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_njrat_smoke-loader_stealc_vidar
- Size 11.9MB
- Sample260729-g35efswfjd
- SHA256 cd10eb7fb16ac02c5fdd9708451366bc31cfbf2447a6bf09e1cde2975d2cf4f7
- MD5 fc9e407f1285a225a9cb49d7ed5db099
- SHA1 0ab4d01d022c13970aef2c723d94ccac05c50586
- SHA512 91861250ea527c063884d1afcde81573a76e6e827e5879523f90db752860317f2b0ad8a3898be9b67b80997e3ed284897262a00f94835d3b61135a2078d52554
- SSDEEP 98304:XMca335GOs0oAaldmdmnpW0oAaldmdmnp2KRuy5aY6RKRuy5a7TIOSARjoD:2IcKmd0NKmd0wqr6RqsTfhoD
- TLSH T11DC6AE03B2E404A6E166D139C9658635D7757C2D4BF286EF32407AD92E73BC17B3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-29_fc9e407f1285a225a9cb49d7ed5db099_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-29_fc9e407f1285a225a9cb49d7ed5db099_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_njrat_smoke-loader_stealc_vidar
- Size 11.9MB
- SHA256 cd10eb7fb16ac02c5fdd9708451366bc31cfbf2447a6bf09e1cde2975d2cf4f7
- MD5 fc9e407f1285a225a9cb49d7ed5db099
- SHA1 0ab4d01d022c13970aef2c723d94ccac05c50586
- SHA512 91861250ea527c063884d1afcde81573a76e6e827e5879523f90db752860317f2b0ad8a3898be9b67b80997e3ed284897262a00f94835d3b61135a2078d52554
- SSDEEP 98304:XMca335GOs0oAaldmdmnpW0oAaldmdmnp2KRuy5aY6RKRuy5a7TIOSARjoD:2IcKmd0NKmd0wqr6RqsTfhoD
- TLSH T11DC6AE03B2E404A6E166D139C9658635D7757C2D4BF286EF32407AD92E73BC17B3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables packed with MEW
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1