futurax | 2026-08-24_ca44e6da3fbd889cd036a516057368e2_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry

Sharing

Target
2026-08-24_ca44e6da3fbd889cd036a516057368e2_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
Size 12.1MB
Sample260825-blh71adp71
SHA256 19add1cc74f129c32d376f2a43c75de6d279f6cb4881ef056a6c52d3a7172a76
MD5 ca44e6da3fbd889cd036a516057368e2
SHA1 d20aa0796adbc10925208045e904463c54e1ffd4
SHA512 b465c7e458f2e40caf0f638dab3d2ecb075b54fb53b41ad539fe9ed651ee20d48895bb969b11e7d3ae17458742a2c8efc31051116d719cce602d946d6bec16c7
SSDEEP 98304:XMca335GOrnUm8UbfkZc0WQtZ/K0tGOFWVRuLftCTCeKRuy5apTIOSAo:2I218UTP0WyZ/K0ttYVAATCeqWTf0
TLSH
T1CCD6AE03B2F84166E06AD639CA755635EB717C1A8BB196DF314076981E33BD0AF39322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm futurax

Detects Futurax 1 IoCs

resource	yara_rule
sample	family_futurax

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables packed with MEW 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_MEW

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_ca44e6da3fbd889cd036a516057368e2_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry

2026-08-24_ca44e6da3fbd889cd036a516057368e2_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry

.exe 12.1MB

SHA256 19add1cc74f129c32d376f2a43c75de6d279f6cb4881ef056a6c52d3a7172a76
MD5 ca44e6da3fbd889cd036a516057368e2
SHA1 d20aa0796adbc10925208045e904463c54e1ffd4
SHA512 b465c7e458f2e40caf0f638dab3d2ecb075b54fb53b41ad539fe9ed651ee20d48895bb969b11e7d3ae17458742a2c8efc31051116d719cce602d946d6bec16c7
SSDEEP 98304:XMca335GOrnUm8UbfkZc0WQtZ/K0tGOFWVRuLftCTCeKRuy5apTIOSAo:2I218UTP0WyZ/K0ttYVAATCeqWTf0
TLSH
T1CCD6AE03B2F84166E06AD639CA755635EB717C1A8BB196DF314076981E33BD0AF39322
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Futurax
Detects executables containing URLs to raw contents of a Github gist
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables packed with MEW
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths