futurax | 2026-08-03_a11d05cb66e649f34acd7ea4caa29ee4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry

Sharing

Target
2026-08-03_a11d05cb66e649f34acd7ea4caa29ee4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
Size 18.8MB
Sample260804-mjnv9attfs
SHA256 0a576b1f97bb8161e88279068f19afa1ecbc5c5686c17f59e578d0f6afd991fb
MD5 a11d05cb66e649f34acd7ea4caa29ee4
SHA1 3db0dd46c58903455fcb6e3968dd3c44ee96a902
SHA512 ddaf6a0a90fbbd6ceb6a98650b5c6890453667853fb6e87042d2814fac92cdbd40e8eadace6aa0fa456982621a20fc2310935ef06c4310bfdde976ca2b92c84b
SSDEEP 196608:5T8qdD66HtIto0ALojcIGoYeGZF6bUpMBF1p/kjRm4OWi2b+Tf+P1:ta6YokI+sIbUwF1VERmj2byw
TLSH
T12B17AF1172B3257DC21F8539C1698D37BA703C295BB18EBB6044F6F42D22B95692BB33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm futurax

Detects Futurax 1 IoCs

resource	yara_rule
sample	family_futurax

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables packed with MEW 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_MEW

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_a11d05cb66e649f34acd7ea4caa29ee4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry

2026-08-03_a11d05cb66e649f34acd7ea4caa29ee4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry

.exe 18.8MB
downloader_req.pyc

574B

SHA256 0a576b1f97bb8161e88279068f19afa1ecbc5c5686c17f59e578d0f6afd991fb
MD5 a11d05cb66e649f34acd7ea4caa29ee4
SHA1 3db0dd46c58903455fcb6e3968dd3c44ee96a902
SHA512 ddaf6a0a90fbbd6ceb6a98650b5c6890453667853fb6e87042d2814fac92cdbd40e8eadace6aa0fa456982621a20fc2310935ef06c4310bfdde976ca2b92c84b
SSDEEP 196608:5T8qdD66HtIto0ALojcIGoYeGZF6bUpMBF1p/kjRm4OWi2b+Tf+P1:ta6YokI+sIbUwF1VERmj2byw
TLSH
T12B17AF1172B3257DC21F8539C1698D37BA703C295BB18EBB6044F6F42D22B95692BB33
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Futurax
Detects executables containing URLs to raw contents of a Github gist
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables packed with MEW
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths