General
- Target 2026-08-12_699b5234233e562f873893f313224728_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 15.9MB
- Sample260813-hbdcbsswbw
- SHA256 15995ccd19a07db829c2aa7cc27c54bde17805a4b22f1bb60f9ec4d4376a643c
- MD5 699b5234233e562f873893f313224728
- SHA1 d756d1fe18bc92b6a2d4e1ebea4b223fa3398f91
- SHA512 874806399ab746991481e7bc011b231ce9bc32e03e6eab62c6605e7674f03e1e283f34b275e3074d5e08666a630e54514dc642cd330f1d743f19dda09dd36bda
- SSDEEP 196608:1WLqTWLqcWLqAoQKmd06o3eGZF6bUpMBF1p/kjRm4OWi2bA:vNK/3q8PIbUwF1VERmj2bA
- TLSH T13AF6CF12F2944271D072D075C9979666EB763C450BB096DF2384B7ED2E33BD1BA3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-12_699b5234233e562f873893f313224728_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-12_699b5234233e562f873893f313224728_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_vidar_wannacry
- Size 15.9MB
- SHA256 15995ccd19a07db829c2aa7cc27c54bde17805a4b22f1bb60f9ec4d4376a643c
- MD5 699b5234233e562f873893f313224728
- SHA1 d756d1fe18bc92b6a2d4e1ebea4b223fa3398f91
- SHA512 874806399ab746991481e7bc011b231ce9bc32e03e6eab62c6605e7674f03e1e283f34b275e3074d5e08666a630e54514dc642cd330f1d743f19dda09dd36bda
- SSDEEP 196608:1WLqTWLqcWLqAoQKmd06o3eGZF6bUpMBF1p/kjRm4OWi2bA:vNK/3q8PIbUwF1VERmj2bA
- TLSH T13AF6CF12F2944271D072D075C9979666EB763C450BB096DF2384B7ED2E33BD1BA3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1