General
- Target 2026-08-02_ae69451c3fbe417cde1c24cc7df8be2e_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 14.2MB
- Sample260802-vr8jmadk2t
- SHA256 73e911a5d511903635212f4fdf00f10f51a083524a0a7da90ff44afe1207e2ca
- MD5 ae69451c3fbe417cde1c24cc7df8be2e
- SHA1 87990666b1c10a5ea0be67805c6389fd28587462
- SHA512 ce1212fb1d68fa1c49d12750f5abdaf54f57c03f94e6d276a03f4bdab6a408f97c3aaf8964d27755892bc1feeb2646528d6b58598846c2bf409d272a0a136da4
- SSDEEP 196608:1WLqTWLqcWLqAozqFeGZF6bUpMBF1p/kjRm4OWi2b8:vNK/e5IbUwF1VERmj2b8
- TLSH T132E6D012F6A44272D073A171C5A7A7AAEE7635110B348ACF1384973D5F33BC19A3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-02_ae69451c3fbe417cde1c24cc7df8be2e_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_ae69451c3fbe417cde1c24cc7df8be2e_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 14.2MB
- SHA256 73e911a5d511903635212f4fdf00f10f51a083524a0a7da90ff44afe1207e2ca
- MD5 ae69451c3fbe417cde1c24cc7df8be2e
- SHA1 87990666b1c10a5ea0be67805c6389fd28587462
- SHA512 ce1212fb1d68fa1c49d12750f5abdaf54f57c03f94e6d276a03f4bdab6a408f97c3aaf8964d27755892bc1feeb2646528d6b58598846c2bf409d272a0a136da4
- SSDEEP 196608:1WLqTWLqcWLqAozqFeGZF6bUpMBF1p/kjRm4OWi2b8:vNK/e5IbUwF1VERmj2b8
- TLSH T132E6D012F6A44272D073A171C5A7A7AAEE7635110B348ACF1384973D5F33BC19A3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1