General
- Target 2026-08-01_03f5e4a530623d9f58efed6d5813998b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 13.2MB
- Sample260801-v9bbvasepd
- SHA256 ed6e474223901eae8e5c019348f1825dca418c581196678bc25f1cad9ac04252
- MD5 03f5e4a530623d9f58efed6d5813998b
- SHA1 5c36c37a8fdc6f16c51ea1d710a3a355fbca1245
- SHA512 9bcc4800ebb2d2a8f4632de18315917f2d8a68ec8e3265ebd39eec7883104c8e459b3e185877fd84dd0885492838080711a1375f39628a3ff038ac753842e123
- SSDEEP 196608:1WLqTWLqcWLqAoQ6ZeGZF6bUpMBF1p/kjRm4OWi2bR:vNK/H9IbUwF1VERmj2bR
- TLSH T11AE6CF12F6A48271D073A175C5E7A7AAEE7635410B308ACB1384977D1F33BD19A3A336
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-01_03f5e4a530623d9f58efed6d5813998b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_03f5e4a530623d9f58efed6d5813998b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 13.2MB
- SHA256 ed6e474223901eae8e5c019348f1825dca418c581196678bc25f1cad9ac04252
- MD5 03f5e4a530623d9f58efed6d5813998b
- SHA1 5c36c37a8fdc6f16c51ea1d710a3a355fbca1245
- SHA512 9bcc4800ebb2d2a8f4632de18315917f2d8a68ec8e3265ebd39eec7883104c8e459b3e185877fd84dd0885492838080711a1375f39628a3ff038ac753842e123
- SSDEEP 196608:1WLqTWLqcWLqAoQ6ZeGZF6bUpMBF1p/kjRm4OWi2bR:vNK/H9IbUwF1VERmj2bR
- TLSH T11AE6CF12F6A48271D073A175C5E7A7AAEE7635410B308ACB1384977D1F33BD19A3A336
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1