General
- Target 2026-07-29_fffd768cf8494a94dc5b3cb9d013c31d_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_njrat_smoke-loader_stealc_vidar
- Size 10.1MB
- Sample260729-g3rhlaweqa
- SHA256 d15479fe3aea34a5f5405e4cbf805a6102bb757953d2b7e8cd12c38eaa23e7e8
- MD5 fffd768cf8494a94dc5b3cb9d013c31d
- SHA1 afa957410315b0443d4ab484c9e9f4cca9b69d4a
- SHA512 f18744143efdb3fa15568209208a405abbb54337e439c84464ce172c2ac8d348545c852ba1a1555851b2274b52782c97bdf2f2e6bab850ead68e04fe6eed763b
- SSDEEP 98304:XMca335GOs0oAaldmdmnpW0oAaldmdmnp2KRuy5aY6QfkZcXfkZccjoM:2IcKmd0NKmd0wqr6OPvPWoM
- TLSH T1DAB67D03F1A846A6D062C075CE86D675EB313C494BF155EB3280B7E92E33AD1BB39725
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-29_fffd768cf8494a94dc5b3cb9d013c31d_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-29_fffd768cf8494a94dc5b3cb9d013c31d_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_njrat_smoke-loader_stealc_vidar
- Size 10.1MB
- SHA256 d15479fe3aea34a5f5405e4cbf805a6102bb757953d2b7e8cd12c38eaa23e7e8
- MD5 fffd768cf8494a94dc5b3cb9d013c31d
- SHA1 afa957410315b0443d4ab484c9e9f4cca9b69d4a
- SHA512 f18744143efdb3fa15568209208a405abbb54337e439c84464ce172c2ac8d348545c852ba1a1555851b2274b52782c97bdf2f2e6bab850ead68e04fe6eed763b
- SSDEEP 98304:XMca335GOs0oAaldmdmnpW0oAaldmdmnp2KRuy5aY6QfkZcXfkZccjoM:2IcKmd0NKmd0wqr6OPvPWoM
- TLSH T1DAB67D03F1A846A6D062C075CE86D675EB313C494BF155EB3280B7E92E33AD1BB39725
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1