General
- Target 2026-08-04_5b2b47e98e81f6fce9514fa66e70acea_amadey_blackenergy_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 15.1MB
- Sample260804-yvr8lagc22
- SHA256 a8d0beeb91dfb3e101a4ae060371486fd296658774686127a2457b19def974c2
- MD5 5b2b47e98e81f6fce9514fa66e70acea
- SHA1 44b64f1d0d841aa3e3e9a96fa01a0a90b9088476
- SHA512 6bf65dad50d14ecff4804796ae6f3d526619ec44893570389a66a685a4644c011d04119be27288b4b439ea7033cef365485ed539cc4a6d9ba0dd4a0ec9b7aed6
- SSDEEP 196608:vGBfW7GBfWAbD9IYbDmzKmd0Coo5oceGZF6bUpMBF1p/kjRm4OWi2b4:UWIWA39IY3HqgvwIbUwF1VERmj2b4
- TLSH T1B6F6C002B29046B6D0768134C9B29225DB317D551BB1D6DF7284B6AA3F73BC0BE37362
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-04_5b2b47e98e81f6fce9514fa66e70acea_amadey_blackenergy_cobalt-strike_elex_glassworm_hijacklo.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_5b2b47e98e81f6fce9514fa66e70acea_amadey_blackenergy_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 15.1MB
- SHA256 a8d0beeb91dfb3e101a4ae060371486fd296658774686127a2457b19def974c2
- MD5 5b2b47e98e81f6fce9514fa66e70acea
- SHA1 44b64f1d0d841aa3e3e9a96fa01a0a90b9088476
- SHA512 6bf65dad50d14ecff4804796ae6f3d526619ec44893570389a66a685a4644c011d04119be27288b4b439ea7033cef365485ed539cc4a6d9ba0dd4a0ec9b7aed6
- SSDEEP 196608:vGBfW7GBfWAbD9IYbDmzKmd0Coo5oceGZF6bUpMBF1p/kjRm4OWi2b4:UWIWA39IY3HqgvwIbUwF1VERmj2b4
- TLSH T1B6F6C002B29046B6D0768134C9B29225DB317D551BB1D6DF7284B6AA3F73BC0BE37362
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1