General
- Target 2026-08-01_390ca60eac65300a041fa8284d261402_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 11.4MB
- Sample260801-vqlcpssakf
- SHA256 d1cf8e99a6064ce813b8023d53ffe644e16d6c2bdb75c769567364b8785ae074
- MD5 390ca60eac65300a041fa8284d261402
- SHA1 95fad4991f80be5217e3263fc54d5f7caccee465
- SHA512 8487783f816ce7922c7d2b797175b9a8b0d3b518e8224914e7cfc18c540b4597a26234e7c3acdad1e4dad7fffd1be00c786d49814279ac9f3ed66767d9176129
- SSDEEP 196608:166HtIto0A+eGZF6bUpMBF1p/kjRm4OWi2bPoz:c6YoGIbUwF1VERmj2bwz
- TLSH T196C6BFA4727339BCC30F9878016DDE737D2028592B416E7B91C5EAB02D1693C696FE72
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-01_390ca60eac65300a041fa8284d261402_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njra.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_390ca60eac65300a041fa8284d261402_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 11.4MB
- SHA256 d1cf8e99a6064ce813b8023d53ffe644e16d6c2bdb75c769567364b8785ae074
- MD5 390ca60eac65300a041fa8284d261402
- SHA1 95fad4991f80be5217e3263fc54d5f7caccee465
- SHA512 8487783f816ce7922c7d2b797175b9a8b0d3b518e8224914e7cfc18c540b4597a26234e7c3acdad1e4dad7fffd1be00c786d49814279ac9f3ed66767d9176129
- SSDEEP 196608:166HtIto0A+eGZF6bUpMBF1p/kjRm4OWi2bPoz:c6YoGIbUwF1VERmj2bwz
- TLSH T196C6BFA4727339BCC30F9878016DDE737D2028592B416E7B91C5EAB02D1693C696FE72
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1