futurax | 2026-08-08_ecb503e4328e875893cf823e5a3586d2_amadey_darkgate_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_ecb503e4328e875893cf823e5a3586d2_amadey_darkgate_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee_vidar
Size 7.2MB
Sample260808-sthd4sttb1
SHA256 3c1bae0597f86b4252a358fd04b31821225d3c1fd87e3877dc645a69c3ebfb98
MD5 ecb503e4328e875893cf823e5a3586d2
SHA1 c13eab147e3de8d367998036a3869bb707ef1123
SHA512 4016e2118d06c98cf1bf62bc81e35c38625161989036c03415576c52b1afd77ba0df769a54222240b132c400141ddfab17186d5b08c332fea7cefa24eba95039
SSDEEP 98304:UoSPIyq2fwIabjKoh9Ws0E2YFGO4dS0rd4TIOSAwjow:VS5X0adXrd4Tf+ow
TLSH
T14B767D1273E44536D07AD27E81A19A69D6717C2A9B3287CF3240BE9E6E737C14637332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm futurax

Malware Config

Signatures

Family: Futurax
Futurax is a Windows worm written in Delphi.
worm futurax

Detects Futurax 1 IoCs

resource	yara_rule
sample	family_futurax

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables packed with MEW 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_MEW

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_ecb503e4328e875893cf823e5a3586d2_amadey_darkgate_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee_vidar

File Explorer

2026-08-08_ecb503e4328e875893cf823e5a3586d2_amadey_darkgate_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee_vidar

.exe 7.2MB

2026-08-08_ecb503e4328e875893cf823e5a3586d2_amadey_darkgate_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee_vidar

SHA256 3c1bae0597f86b4252a358fd04b31821225d3c1fd87e3877dc645a69c3ebfb98
MD5 ecb503e4328e875893cf823e5a3586d2
SHA1 c13eab147e3de8d367998036a3869bb707ef1123
SHA512 4016e2118d06c98cf1bf62bc81e35c38625161989036c03415576c52b1afd77ba0df769a54222240b132c400141ddfab17186d5b08c332fea7cefa24eba95039
SSDEEP 98304:UoSPIyq2fwIabjKoh9Ws0E2YFGO4dS0rd4TIOSAwjow:VS5X0adXrd4Tf+ow
TLSH
T14B767D1273E44536D07AD27E81A19A69D6717C2A9B3287CF3240BE9E6E737C14637332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Futurax
Detects executables containing URLs to raw contents of a Github gist
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables packed with MEW
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths