General
- Target 2026-08-01_431ebaca557e7f81402af9d54c2e3408_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry
- Size 9.1MB
- Sample260801-q97ylabe75
- SHA256 0e80210da24afe61f75e332c742dda2e86db862918d3e60930ad9dc27f75bbb2
- MD5 431ebaca557e7f81402af9d54c2e3408
- SHA1 8e2698656cc2379447ae54d5e574fb26c761a0e6
- SHA512 e654c6bbb266663056dac552cdba7cbad2b745f586198c43fce888b3c77398c214c70313311893342a1243595b6d5517476bf45416c52d698ea573aecb9400d8
- SSDEEP 98304:Uldc+sNi9XwgwfoM9nKwFxdf5P7KRuy5a9daLapIA0oAaldmdmnpA6J:ski9XwgwAMtPdf5P7qAdacItKmd0i6J
- TLSH T18FA67C13B2E104A5D1A6D134CF569231EBB67C294BF192EF3244B6D92E33AC07B39716
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-01_431ebaca557e7f81402af9d54c2e3408_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_431ebaca557e7f81402af9d54c2e3408_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry
- Size 9.1MB
- SHA256 0e80210da24afe61f75e332c742dda2e86db862918d3e60930ad9dc27f75bbb2
- MD5 431ebaca557e7f81402af9d54c2e3408
- SHA1 8e2698656cc2379447ae54d5e574fb26c761a0e6
- SHA512 e654c6bbb266663056dac552cdba7cbad2b745f586198c43fce888b3c77398c214c70313311893342a1243595b6d5517476bf45416c52d698ea573aecb9400d8
- SSDEEP 98304:Uldc+sNi9XwgwfoM9nKwFxdf5P7KRuy5a9daLapIA0oAaldmdmnpA6J:ski9XwgwAMtPdf5P7qAdacItKmd0i6J
- TLSH T18FA67C13B2E104A5D1A6D134CF569231EBB67C294BF192EF3244B6D92E33AC07B39716
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1