General
- Target 2026-08-18_f5379c88de410632a8023443ec914e6e_amadey_blackenergy_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_rhadamanthys_smoke-loader_stop_vidar
- Size 12.8MB
- Sample260818-2m2nvasanb
- SHA256 fb6881c0192f6c656604255783eaea79c8bca457be2cd218f4786a693ea2a8d5
- MD5 f5379c88de410632a8023443ec914e6e
- SHA1 60b0da30ec3ada92669d2bbf9111d1168be6b4a4
- SHA512 5022bf42995b9f17516d5f7b75fddd0e160025d733ee2bd9b9a23a8ea38a9b110f933686aa63f7d30ec6d1a3f0493bed9b2b86db3c1f6ea6f5a69287f3b046c9
- SSDEEP 196608:XGBfWAa/I+mhS1qf7or66HtItoBd95omWyZ/K0ttYVAATY:sWASI+PQfE26YoohyZ/K0ttYZTY
- TLSH T139D66E51B2B3217CC25B957485799A33BA313C550BB05DFF2184F6F42E32AD46A3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-18_f5379c88de410632a8023443ec914e6e_amadey_blackenergy_cobalt-strike_elex_emotet_glassworm_h.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-18_f5379c88de410632a8023443ec914e6e_amadey_blackenergy_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_rhadamanthys_smoke-loader_stop_vidar
- Size 12.8MB
- SHA256 fb6881c0192f6c656604255783eaea79c8bca457be2cd218f4786a693ea2a8d5
- MD5 f5379c88de410632a8023443ec914e6e
- SHA1 60b0da30ec3ada92669d2bbf9111d1168be6b4a4
- SHA512 5022bf42995b9f17516d5f7b75fddd0e160025d733ee2bd9b9a23a8ea38a9b110f933686aa63f7d30ec6d1a3f0493bed9b2b86db3c1f6ea6f5a69287f3b046c9
- SSDEEP 196608:XGBfWAa/I+mhS1qf7or66HtItoBd95omWyZ/K0ttYVAATY:sWASI+PQfE26YoohyZ/K0ttYZTY
- TLSH T139D66E51B2B3217CC25B957485799A33BA313C550BB05DFF2184F6F42E32AD46A3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1