General
- Target 2026-07-30_043bdb8458e4a7c79fa0207a81bb7e75_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stealc_vidar
- Size 14.2MB
- Sample260730-wws56sdd94
- SHA256 d25c111241e49477f2fa3f47285fd583814c1bd6bf8cf6bc8f0cc3c227fc938e
- MD5 043bdb8458e4a7c79fa0207a81bb7e75
- SHA1 700e3608306ef859158516480d2bcf14c3254945
- SHA512 d0d5e01851c0f9341c03e10520c6ca58b6cb285982e9cfec5101f1078c92866a92408492f63122b0e0241ec9647f8238c65ab04d2adaf7deefc04e1ce1ca8dc9
- SSDEEP 196608:2IpXdbuofWyZ/K0ttYVAAT4oiWyZ/K0ttYVAAToo2:2IVOyZ/K0ttYZT39yZ/K0ttYZTH2
- TLSH T109E67D03F2A441B9E06AD178CA669725DB327C558BF1A9DF224076D82F73AD07B38731
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-30_043bdb8458e4a7c79fa0207a81bb7e75_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-30_043bdb8458e4a7c79fa0207a81bb7e75_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_smoke-loader_stealc_vidar
- Size 14.2MB
- SHA256 d25c111241e49477f2fa3f47285fd583814c1bd6bf8cf6bc8f0cc3c227fc938e
- MD5 043bdb8458e4a7c79fa0207a81bb7e75
- SHA1 700e3608306ef859158516480d2bcf14c3254945
- SHA512 d0d5e01851c0f9341c03e10520c6ca58b6cb285982e9cfec5101f1078c92866a92408492f63122b0e0241ec9647f8238c65ab04d2adaf7deefc04e1ce1ca8dc9
- SSDEEP 196608:2IpXdbuofWyZ/K0ttYVAAT4oiWyZ/K0ttYVAAToo2:2IVOyZ/K0ttYZT39yZ/K0ttYZTH2
- TLSH T109E67D03F2A441B9E06AD178CA669725DB327C558BF1A9DF224076D82F73AD07B38731
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1