General
- Target 2026-08-03_7a087963e927add64120982ff36254f0_amadey_blackenergy_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_rhadamanthys_smoke-loader_stop_vidar
- Size 11.0MB
- Sample260804-nbs1nsdm2t
- SHA256 da9d70daf2607f947187e57e4b9b95e74a1bae08ea190b0892db457291e60428
- MD5 7a087963e927add64120982ff36254f0
- SHA1 3c4cde7704eea2eff05156c6e3f531d2e76f80c7
- SHA512 2d6b8b32306eb290d8182bd63a0283a0b67a6b8671e111f98b45683b142a0592c43812ef93db19a63d58f13126273b7a882d39f7bb446448ea57705c1b375a5d
- SSDEEP 196608:XGBfWAa/I+mhS1qfPKmd0ddodCdgoyoKq+06C:sWASI+PQfyqglzIC
- TLSH T12AC68D02B2A441B5D077D174C9A29675EB727C450BB096DF2284F7E92E33BD0BE36722
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-03_7a087963e927add64120982ff36254f0_amadey_blackenergy_cobalt-strike_elex_emotet_glassworm_h.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_7a087963e927add64120982ff36254f0_amadey_blackenergy_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_rhadamanthys_smoke-loader_stop_vidar
- Size 11.0MB
- SHA256 da9d70daf2607f947187e57e4b9b95e74a1bae08ea190b0892db457291e60428
- MD5 7a087963e927add64120982ff36254f0
- SHA1 3c4cde7704eea2eff05156c6e3f531d2e76f80c7
- SHA512 2d6b8b32306eb290d8182bd63a0283a0b67a6b8671e111f98b45683b142a0592c43812ef93db19a63d58f13126273b7a882d39f7bb446448ea57705c1b375a5d
- SSDEEP 196608:XGBfWAa/I+mhS1qfPKmd0ddodCdgoyoKq+06C:sWASI+PQfyqglzIC
- TLSH T12AC68D02B2A441B5D077D174C9A29675EB727C450BB096DF2284F7E92E33BD0BE36722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1