General
- Target 2026-08-14_2eba6d6c799c323153b5b1162eb81354_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
- Size 11.5MB
- Sample260815-ae19kavyev
- SHA256 03729e47e4be4bbb849d2bb88f23f3ad31e025f8209c51ef84bcaae17ae3fb7d
- MD5 2eba6d6c799c323153b5b1162eb81354
- SHA1 69ca4ed8213fc5975b9338a91aacfe718ddc2439
- SHA512 6e4d965914d4c0a4cdda30153e95b863830202e10a1a19f917ee731cb964c239807a713cc4753851d0278f06b76bd3916dfddcaf311b381202b1634e02bd7c5c
- SSDEEP 98304:XMca335GOshgdnLapIzdVjoX6pt3WQtZ/K0tGOFWVRuLftCT/:2IpgdncIzdhoX6pt3WyZ/K0ttYVAAT/
- TLSH T18EC67C13F2E441A5D066D174CFA69725EB723C558BF096DF2244B2D82F33AD0BA39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-14_2eba6d6c799c323153b5b1162eb81354_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_smok.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-14_2eba6d6c799c323153b5b1162eb81354_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
- Size 11.5MB
- SHA256 03729e47e4be4bbb849d2bb88f23f3ad31e025f8209c51ef84bcaae17ae3fb7d
- MD5 2eba6d6c799c323153b5b1162eb81354
- SHA1 69ca4ed8213fc5975b9338a91aacfe718ddc2439
- SHA512 6e4d965914d4c0a4cdda30153e95b863830202e10a1a19f917ee731cb964c239807a713cc4753851d0278f06b76bd3916dfddcaf311b381202b1634e02bd7c5c
- SSDEEP 98304:XMca335GOshgdnLapIzdVjoX6pt3WQtZ/K0tGOFWVRuLftCT/:2IpgdncIzdhoX6pt3WyZ/K0ttYVAAT/
- TLSH T18EC67C13F2E441A5D066D174CFA69725EB723C558BF096DF2244B2D82F33AD0BA39722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1