General
- Target 2026-08-24_1d58b543e04d6d85ccd066e2b57d2a23_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
- Size 10.5MB
- Sample260825-wb2a2sdj4t
- SHA256 a0c64db0708ddfc618156fc3f4f0fc21cfe7487420a9b6865b8f2d1ab8428322
- MD5 1d58b543e04d6d85ccd066e2b57d2a23
- SHA1 5b0024a946a918cde0bc618bfe83215277e19f1b
- SHA512 fdc923b4e3ae0545bd0ef5c01c6c6829959fe25805d1a56d2159d2f9294f9d19320dca227d3d746149cac30cf972eaff97343992f2049a3e5402f03aeeb6ae4a
- SSDEEP 98304:XMca335GOrnUm8UbfkZc0WQtZ/K0tGOFWVRuLftCTCeKRuy5aVfkZce:2I218UTP0WyZ/K0ttYVAATCeqkPe
- TLSH T1E3B68E03F2B842A6E076D574CAAA9765EA323C054BB195DF124073982F37AD0BF39735
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-24_1d58b543e04d6d85ccd066e2b57d2a23_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_n.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-24_1d58b543e04d6d85ccd066e2b57d2a23_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_njrat_smoke-loader_stealc_vidar_wannacry
- Size 10.5MB
- SHA256 a0c64db0708ddfc618156fc3f4f0fc21cfe7487420a9b6865b8f2d1ab8428322
- MD5 1d58b543e04d6d85ccd066e2b57d2a23
- SHA1 5b0024a946a918cde0bc618bfe83215277e19f1b
- SHA512 fdc923b4e3ae0545bd0ef5c01c6c6829959fe25805d1a56d2159d2f9294f9d19320dca227d3d746149cac30cf972eaff97343992f2049a3e5402f03aeeb6ae4a
- SSDEEP 98304:XMca335GOrnUm8UbfkZc0WQtZ/K0tGOFWVRuLftCTCeKRuy5aVfkZce:2I218UTP0WyZ/K0ttYVAATCeqkPe
- TLSH T1E3B68E03F2B842A6E076D574CAAA9765EA323C054BB195DF124073982F37AD0BF39735
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1