General
- Target 2026-08-06_caf30a74dbd443bfd7431cfb18949519_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_vidar
- Size 10.7MB
- Sample260806-2hzzfssaqe
- SHA256 3d824186d09ba7c4e8abd87e07b4fbb3efc6c8409219fe6762aed2c02c5c4ff3
- MD5 caf30a74dbd443bfd7431cfb18949519
- SHA1 c9e0e3e12bcb2de218f27f4112a9fb80208e8a4e
- SHA512 982eba9f9f01f50e3742b83036603271fbd891425e82f862dda814ec57389c15542dd00c2d2dd022aabbfa4cfcd7f805a8b2a55dd025c4a7e0092a38cc7ad803
- SSDEEP 98304:HcRIE/jolDujoQxQeMjLsAAa/7JN5evoirV0t/iLwHft8vADjoF:IvolEoneGZF6jrOOwH+vGoF
- TLSH T10FB6291176958FE9C05FD074CA8665B69A237C868F309FCB0980BE283E766F45E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-06_caf30a74dbd443bfd7431cfb18949519_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_caf30a74dbd443bfd7431cfb18949519_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-06_caf30a74dbd443bfd7431cfb18949519_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_rhadamanthys_smoke-loader_stealc_vidar
- Size 10.7MB
- SHA256 3d824186d09ba7c4e8abd87e07b4fbb3efc6c8409219fe6762aed2c02c5c4ff3
- MD5 caf30a74dbd443bfd7431cfb18949519
- SHA1 c9e0e3e12bcb2de218f27f4112a9fb80208e8a4e
- SHA512 982eba9f9f01f50e3742b83036603271fbd891425e82f862dda814ec57389c15542dd00c2d2dd022aabbfa4cfcd7f805a8b2a55dd025c4a7e0092a38cc7ad803
- SSDEEP 98304:HcRIE/jolDujoQxQeMjLsAAa/7JN5evoirV0t/iLwHft8vADjoF:IvolEoneGZF6jrOOwH+vGoF
- TLSH T10FB6291176958FE9C05FD074CA8665B69A237C868F309FCB0980BE283E766F45E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory