General
- Target 2026-08-15_1b8a4159e5dce0ca5512e861da93c4ac_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stealc_stop_vidar
- Size 12.6MB
- Sample260816-a8ebwsaq51
- SHA256 7d785f989c3046d171cc5c6137e33ea3de7152db7ed34a80a0da81b733dfc13e
- MD5 1b8a4159e5dce0ca5512e861da93c4ac
- SHA1 5b9b118a28f01a1a204a287d04c41e10c91e11f9
- SHA512 c984c66c0183a585b18c20c78033082288aee6aff91f5ab760a5d4a88d49dbc0736b39426ca220e820cbee33b43f4e26bff7f9dd317db5fb2ba74e91747d96df
- SSDEEP 196608:3GTJJodeGZF6bUpMBF1p/kjRm4OWi2jrOOwH+vGo+:2cRIbUwF1VERmj2jrOB+p+
- TLSH T116D66A1165D98FE8C05FD474CE8665B69A237C868F309FDB0980BE283E766E45E3421F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_1b8a4159e5dce0ca5512e861da93c4ac_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_1b8a4159e5dce0ca5512e861da93c4ac_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-15_1b8a4159e5dce0ca5512e861da93c4ac_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stealc_stop_vidar
- Size 12.6MB
- SHA256 7d785f989c3046d171cc5c6137e33ea3de7152db7ed34a80a0da81b733dfc13e
- MD5 1b8a4159e5dce0ca5512e861da93c4ac
- SHA1 5b9b118a28f01a1a204a287d04c41e10c91e11f9
- SHA512 c984c66c0183a585b18c20c78033082288aee6aff91f5ab760a5d4a88d49dbc0736b39426ca220e820cbee33b43f4e26bff7f9dd317db5fb2ba74e91747d96df
- SSDEEP 196608:3GTJJodeGZF6bUpMBF1p/kjRm4OWi2jrOOwH+vGo+:2cRIbUwF1VERmj2jrOB+p+
- TLSH T116D66A1165D98FE8C05FD474CE8665B69A237C868F309FDB0980BE283E766E45E3421F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory