General
- Target 2026-08-03_f1b9b40bad7c0c9803931622fe531ec7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 18.0MB
- Sample260803-tzpaaacb77
- SHA256 b1f585bd83d666c3a9205cd918fb3e75bffcb3682b352ec61b92d820757eecc4
- MD5 f1b9b40bad7c0c9803931622fe531ec7
- SHA1 bee5dda74834cbe01ae9d16dbf2d39eaabac6f80
- SHA512 37e9061632aa22a743b359e85b608ccca20602a74ebdb9c4a3b2d65ef3fad8d56fde4ffe15da6f0c940a99774318384cac5c60fba570ec8f31aec46df7ae34ed
- SSDEEP 196608:5T8qdD66HtIto0ALojcIGoYeGZF6bUpMBF1p/kjRm4OWi2b+Tf6:ta6YokI+sIbUwF1VERmj2byi
- TLSH T1D217AE2132F3257DC21F853981698D36BA703C295BB18E7B6084F6F42D62B55792BB33
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-03_f1b9b40bad7c0c9803931622fe531ec7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_f1b9b40bad7c0c9803931622fe531ec7_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 18.0MB
- SHA256 b1f585bd83d666c3a9205cd918fb3e75bffcb3682b352ec61b92d820757eecc4
- MD5 f1b9b40bad7c0c9803931622fe531ec7
- SHA1 bee5dda74834cbe01ae9d16dbf2d39eaabac6f80
- SHA512 37e9061632aa22a743b359e85b608ccca20602a74ebdb9c4a3b2d65ef3fad8d56fde4ffe15da6f0c940a99774318384cac5c60fba570ec8f31aec46df7ae34ed
- SSDEEP 196608:5T8qdD66HtIto0ALojcIGoYeGZF6bUpMBF1p/kjRm4OWi2b+Tf6:ta6YokI+sIbUwF1VERmj2byi
- TLSH T1D217AE2132F3257DC21F853981698D36BA703C295BB18E7B6084F6F42D62B55792BB33
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables packed with MEW
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1