General
- Target 2026-08-04_ca083f42248a4133bc4d5d4939168ca6_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_njrat_remcos_stealc_vidar_wannacry
- Size 7.9MB
- Sample260804-wtke9at1bz
- SHA256 056a0a065a6cfe5c8558bc688229fd355ed17a759aa6ece94406ad2a7f24eb3c
- MD5 ca083f42248a4133bc4d5d4939168ca6
- SHA1 0bc75768248fd18163ba30f817f7b1a97e543c1b
- SHA512 1854d700e0411d165a77c38d2c5bd1e78d0993394b88c24c660033364de01742fccfae1091005895f0937f3d945df25f7001570c75babdfefaab454eb876822d
- SSDEEP 98304:VHRSbXsPN5kiQaZ5rjoKHRSbXsPN5kiQaZ5rjoB3a:1j5VPfoYj5VPfoxa
- TLSH T19B86C32166E4CFE1D06F5070DC66BAF69127AD20CF654FCB2E807E1939316D2A931A1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-04_ca083f42248a4133bc4d5d4939168ca6_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_ca083f42248a4133bc4d5d4939168ca6_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-stealer_njrat_remcos_stealc_vidar_wannacry
- Size 7.9MB
- SHA256 056a0a065a6cfe5c8558bc688229fd355ed17a759aa6ece94406ad2a7f24eb3c
- MD5 ca083f42248a4133bc4d5d4939168ca6
- SHA1 0bc75768248fd18163ba30f817f7b1a97e543c1b
- SHA512 1854d700e0411d165a77c38d2c5bd1e78d0993394b88c24c660033364de01742fccfae1091005895f0937f3d945df25f7001570c75babdfefaab454eb876822d
- SSDEEP 98304:VHRSbXsPN5kiQaZ5rjoKHRSbXsPN5kiQaZ5rjoB3a:1j5VPfoYj5VPfoxa
- TLSH T19B86C32166E4CFE1D06F5070DC66BAF69127AD20CF654FCB2E807E1939316D2A931A1F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1