General
- Target 2026-08-24_547a6a49a84959441cf72da33cda09c8_amadey_blackenergy_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar_wannacry
- Size 9.1MB
- Sample260825-qfsltasfmg
- SHA256 b62587ceb87c6682f9e13cb5edb2731618829727e52fd51f9e35d6c74f0c2dab
- MD5 547a6a49a84959441cf72da33cda09c8
- SHA1 18f1a46a5be4f3e27842875957c0fb9e5ab7910a
- SHA512 2d1654304364324e5dc05a44eb0785f99db2a257921445f16027b321b8136aa3d14b22f0a729a0b07c9dbc59586fc4e438780e365323d7b04c8569a85f5d9bd4
- SSDEEP 196608:XGBfW846DD2S9+ULdNPtbuPZOOmnqogHh/WdiH60:sWG32SlLdNPt6ROOmqZq0
- TLSH T1B9A6D02EF7A44132D0779176C8A59265DA32F8519734CBCB1388972DAF336C39E36362
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-24_547a6a49a84959441cf72da33cda09c8_amadey_blackenergy_cobalt-strike_darkgate_elex_glassworm.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-24_547a6a49a84959441cf72da33cda09c8_amadey_blackenergy_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_luca-stealer_njrat_vidar_wannacry
- Size 9.1MB
- SHA256 b62587ceb87c6682f9e13cb5edb2731618829727e52fd51f9e35d6c74f0c2dab
- MD5 547a6a49a84959441cf72da33cda09c8
- SHA1 18f1a46a5be4f3e27842875957c0fb9e5ab7910a
- SHA512 2d1654304364324e5dc05a44eb0785f99db2a257921445f16027b321b8136aa3d14b22f0a729a0b07c9dbc59586fc4e438780e365323d7b04c8569a85f5d9bd4
- SSDEEP 196608:XGBfW846DD2S9+ULdNPtbuPZOOmnqogHh/WdiH60:sWG32SlLdNPt6ROOmqZq0
- TLSH T1B9A6D02EF7A44132D0779176C8A59265DA32F8519734CBCB1388972DAF336C39E36362
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1