General
- Target 2026-08-27_eecaf0e551716f7f085f650613adf619_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry
- Size 13.5MB
- Sample260828-cyv8rsbf37
- SHA256 f8e3c00ca86b7db87ad986e079c690e91b91b75a52fa6828b2fa0d219d13a623
- MD5 eecaf0e551716f7f085f650613adf619
- SHA1 585b92b6eebb1df0b3b4e563ffe42af1bb2c0fe0
- SHA512 d10a06beb1feaa64036f1f0a710921df867827d60377e9a8fa8fed27e822360cd59405ffa2ef415dfd59b4484d88b32ae587cf1fff4588d4ffd9484cf7221bd9
- SSDEEP 196608:1WLqTWLqcWLqAoJtmgTH2qBpu1QfLIqsufcdH:vNK/tTHNBpu1Qfc0u
- TLSH T195E63A12A2D58FA9D06FE474C95666A5AA333C414F309FDF06847E293E326E09E3531F
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-27_eecaf0e551716f7f085f650613adf619_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-27_eecaf0e551716f7f085f650613adf619_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar_wannacry
- Size 13.5MB
- SHA256 f8e3c00ca86b7db87ad986e079c690e91b91b75a52fa6828b2fa0d219d13a623
- MD5 eecaf0e551716f7f085f650613adf619
- SHA1 585b92b6eebb1df0b3b4e563ffe42af1bb2c0fe0
- SHA512 d10a06beb1feaa64036f1f0a710921df867827d60377e9a8fa8fed27e822360cd59405ffa2ef415dfd59b4484d88b32ae587cf1fff4588d4ffd9484cf7221bd9
- SSDEEP 196608:1WLqTWLqcWLqAoJtmgTH2qBpu1QfLIqsufcdH:vNK/tTHNBpu1Qfc0u
- TLSH T195E63A12A2D58FA9D06FE474C95666A5AA333C414F309FDF06847E293E326E09E3531F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1