General
- Target 2026-09-01_6978197e46c280ee91ecea58a604227d_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_stealc_vidar_wannacry
- Size 9.6MB
- Sample260903-mjacvsfk6w
- SHA256 d557b899afda6ac4ca9dadbeeda40d07653f26d9728b7961067e7023ecf1abef
- MD5 6978197e46c280ee91ecea58a604227d
- SHA1 e80a0cb2ff4962f8a65dcdf6a0c7c1a892991bf0
- SHA512 2c4466de43747589b4b74d98ceb0d575726e5902922b951cd9e3f9eae065ee4bcdd24dad9a377f9a1d674e0d8527bb5f43b63183bdc865b7bc7156f41df29c9d
- SSDEEP 98304:XMca335GjnMca334Mca335Gj+xh6InUm8UK0oAaldmdmnp3joIdfkZcp:2IaZIaxh6I18U/Kmd0xo4Pp
- TLSH T1E6A69F02F6A881B1D063C074CA96D776EE717C551BB095DF2380B6E82E33AD1BB39725
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-09-01_6978197e46c280ee91ecea58a604227d_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_l.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-01_6978197e46c280ee91ecea58a604227d_amadey_cobalt-strike_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_remcos_smoke-loader_stealc_vidar_wannacry
- Size 9.6MB
- SHA256 d557b899afda6ac4ca9dadbeeda40d07653f26d9728b7961067e7023ecf1abef
- MD5 6978197e46c280ee91ecea58a604227d
- SHA1 e80a0cb2ff4962f8a65dcdf6a0c7c1a892991bf0
- SHA512 2c4466de43747589b4b74d98ceb0d575726e5902922b951cd9e3f9eae065ee4bcdd24dad9a377f9a1d674e0d8527bb5f43b63183bdc865b7bc7156f41df29c9d
- SSDEEP 98304:XMca335GjnMca334Mca335Gj+xh6InUm8UK0oAaldmdmnp3joIdfkZcp:2IaZIaxh6I18U/Kmd0xo4Pp
- TLSH T1E6A69F02F6A881B1D063C074CA96D776EE717C551BB095DF2380B6E82E33AD1BB39725
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Futurax
-
Detects executables packed with MEW
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1