General
- Target 2026-08-04_2cf329628b317fe3f66f3e4521a0b56e_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 9.4MB
- Sample260804-zldvaazdke
- SHA256 837da3bc629022069b92a3e4026d9b4cc8f40216dfd78739a0a754a828701f36
- MD5 2cf329628b317fe3f66f3e4521a0b56e
- SHA1 b0d4dfd0772129b850742fab0eb7f6fb3f562dae
- SHA512 c94c1c8d434a449b4b70532b51ada976f81bf5b0754d0b467778a3555641d70ce0528a9b9e610d4b39d65822514f61179ae6e9043e83128d9f01470e206617f0
- SSDEEP 98304:Uldc+sNi9XwgwfoM9nKwFxdf5PLapILzHKRuy5aELapIBKRuy5ahxQeMjLsAA2:ski9XwgwAMtPdf5PcIXqBcIBqNeGZh
- TLSH T146A68C2272E204A5D2AA9031CF66933157E57C388FF1D3AB725476D92F729C07A3970B
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-04_2cf329628b317fe3f66f3e4521a0b56e_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_l.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_2cf329628b317fe3f66f3e4521a0b56e_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 9.4MB
- SHA256 837da3bc629022069b92a3e4026d9b4cc8f40216dfd78739a0a754a828701f36
- MD5 2cf329628b317fe3f66f3e4521a0b56e
- SHA1 b0d4dfd0772129b850742fab0eb7f6fb3f562dae
- SHA512 c94c1c8d434a449b4b70532b51ada976f81bf5b0754d0b467778a3555641d70ce0528a9b9e610d4b39d65822514f61179ae6e9043e83128d9f01470e206617f0
- SSDEEP 98304:Uldc+sNi9XwgwfoM9nKwFxdf5PLapILzHKRuy5aELapIBKRuy5ahxQeMjLsAA2:ski9XwgwAMtPdf5PcIXqBcIBqNeGZh
- TLSH T146A68C2272E204A5D2AA9031CF66933157E57C388FF1D3AB725476D92F729C07A3970B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1