futurax | 2026-08-03_dd387bdd73231cc20c041019c86376e4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry

Sharing

Target
2026-08-03_dd387bdd73231cc20c041019c86376e4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
Size 18.5MB
Sample260804-lbc84sstbs
SHA256 bd2f219cd79252c3d323771543c0800a4a693ba4878af6c6fe40de7744561a3f
MD5 dd387bdd73231cc20c041019c86376e4
SHA1 fbe29ff588e301b9ee84c7861dc1798e1e9be689
SHA512 be0b2b70e94d44e0091693be1956777006c859b93d46984cc302e3bdf873761ab16c63898d50bae06c350a8282d6a9c90cecba1ac9f898c85f83eb16cf3c6564
SSDEEP 196608:5T8qdD66HtIto0ALojcIGoYeGZF6bUpMBF1p/kjRm4OWi2b+Tfwd:ta6YokI+sIbUwF1VERmj2byo
TLSH
T14D17AF2172F3257DC21F853981698D37BA703C295BB18E7B6084F6F42D22B55692BB33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm futurax

Detects Futurax 1 IoCs

resource	yara_rule
sample	family_futurax

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables packed with MEW 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_MEW

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_dd387bdd73231cc20c041019c86376e4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry

2026-08-03_dd387bdd73231cc20c041019c86376e4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry

.exe 18.5MB
downloader_req.pyc

574B

SHA256 bd2f219cd79252c3d323771543c0800a4a693ba4878af6c6fe40de7744561a3f
MD5 dd387bdd73231cc20c041019c86376e4
SHA1 fbe29ff588e301b9ee84c7861dc1798e1e9be689
SHA512 be0b2b70e94d44e0091693be1956777006c859b93d46984cc302e3bdf873761ab16c63898d50bae06c350a8282d6a9c90cecba1ac9f898c85f83eb16cf3c6564
SSDEEP 196608:5T8qdD66HtIto0ALojcIGoYeGZF6bUpMBF1p/kjRm4OWi2b+Tfwd:ta6YokI+sIbUwF1VERmj2byo
TLSH
T14D17AF2172F3257DC21F853981698D37BA703C295BB18E7B6084F6F42D22B55692BB33
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Futurax
Detects executables containing URLs to raw contents of a Github gist
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables packed with MEW
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths