General
- Target 2026-07-30_bd50f57fcddc3d2235161df61234db68_amadey_blackenergy_cobalt-strike_darkgate_elex_emotet_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_vidar
- Size 10.7MB
- Sample260730-14fl9sgk9t
- SHA256 f897024cd9db27badc8c96f80838a8e1443be8386a1e7e68c73b4f3aa98bd16e
- MD5 bd50f57fcddc3d2235161df61234db68
- SHA1 6ebb608bb6d8e413fd1ba7b08350bbfef7dae3bf
- SHA512 c7f526cf89c2d12e05085fead381ad4a39ff099d717f6424f76ac54c19fad1ccfca572984b2e299fcb19fbcb726242afaa3bb51a4a128107264d67cb818c4056
- SSDEEP 196608:XGBfWAa/I+mhS1qfPKmd0ddodCdgoyoKqU6e:sWASI+PQfyqglzje
- TLSH T10AB67C02B29441B5D0779134C9A29239EB727C4547B19ADF2284FAED2F73BD06E36732
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-30_bd50f57fcddc3d2235161df61234db68_amadey_blackenergy_cobalt-strike_darkgate_elex_emotet_gl.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-30_bd50f57fcddc3d2235161df61234db68_amadey_blackenergy_cobalt-strike_darkgate_elex_emotet_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_vidar
- Size 10.7MB
- SHA256 f897024cd9db27badc8c96f80838a8e1443be8386a1e7e68c73b4f3aa98bd16e
- MD5 bd50f57fcddc3d2235161df61234db68
- SHA1 6ebb608bb6d8e413fd1ba7b08350bbfef7dae3bf
- SHA512 c7f526cf89c2d12e05085fead381ad4a39ff099d717f6424f76ac54c19fad1ccfca572984b2e299fcb19fbcb726242afaa3bb51a4a128107264d67cb818c4056
- SSDEEP 196608:XGBfWAa/I+mhS1qfPKmd0ddodCdgoyoKqU6e:sWASI+PQfyqglzje
- TLSH T10AB67C02B29441B5D0779134C9A29239EB727C4547B19ADF2284FAED2F73BD06E36732
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1