General
- Target 2026-08-05_9bc05994583e0a49043413b9952feb98_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 15.4MB
- Sample260805-wf55ssda38
- SHA256 7e280c2dab37053da1650323ec8830911b3dfa4b1c14e25be4c50100eb1a2476
- MD5 9bc05994583e0a49043413b9952feb98
- SHA1 9bc767bebc4228d64b97cec9bcb37c2f3451ccee
- SHA512 9ee8e1e49db173c89b620bc8303a59f71e04878d4980beac32236f6a42d5695e2ef0e11bf07a4a3361678e24a2b3c0a26fc61df848a7dbb6f8b16c47bb8546f6
- SSDEEP 196608:Ldkdcdeo0Kmd0FqLeGZF6bUpMBF1p/kjRm4OWi2bE:nDqVDIbUwF1VERmj2bE
- TLSH T12EF6D003B69405F5D066C130C9778676EA753C1907B1E6EF2298B6E62E33AD13F38762
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-05_9bc05994583e0a49043413b9952feb98_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-05_9bc05994583e0a49043413b9952feb98_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 15.4MB
- SHA256 7e280c2dab37053da1650323ec8830911b3dfa4b1c14e25be4c50100eb1a2476
- MD5 9bc05994583e0a49043413b9952feb98
- SHA1 9bc767bebc4228d64b97cec9bcb37c2f3451ccee
- SHA512 9ee8e1e49db173c89b620bc8303a59f71e04878d4980beac32236f6a42d5695e2ef0e11bf07a4a3361678e24a2b3c0a26fc61df848a7dbb6f8b16c47bb8546f6
- SSDEEP 196608:Ldkdcdeo0Kmd0FqLeGZF6bUpMBF1p/kjRm4OWi2bE:nDqVDIbUwF1VERmj2bE
- TLSH T12EF6D003B69405F5D066C130C9778676EA753C1907B1E6EF2298B6E62E33AD13F38762
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1