General
- Target 2026-09-11_311d4815c8472db76804cff6298fe436_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_stealc_vidar_wannacry
- Size 9.6MB
- Sample260912-nv3n8awdkc
- SHA256 7fd3f8b9993590f930013c9014bb61722e817603ac49a40f2b98612b69b5f5df
- MD5 311d4815c8472db76804cff6298fe436
- SHA1 e323db4a5cb7b35b234f4ae0fca72a93f6562756
- SHA512 1cb81b46f383099a5cfa48b2eb1de5247bd7352af2e6c16e4a507d3edcc7e25cb936f951c450bb96996b600a3fd512e86e7c7874e8b1295acba6463ad70e0b79
- SSDEEP 98304:5fKUgTH2M2m9UMpu1QfLczqssnKSsuw6Kui+w32+QDENms2f:59gTH2qBpu1QfLIqsufsz5ui+LjENa
- TLSH T127A6292162D98FACC05FE034CE4676A566337C458F21AFDF19847E293E726A05E3921F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-09-11_311d4815c8472db76804cff6298fe436_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Resource
win10v2004-20260911-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-11_311d4815c8472db76804cff6298fe436_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-11_311d4815c8472db76804cff6298fe436_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_remcos_stealc_vidar_wannacry
- Size 9.6MB
- SHA256 7fd3f8b9993590f930013c9014bb61722e817603ac49a40f2b98612b69b5f5df
- MD5 311d4815c8472db76804cff6298fe436
- SHA1 e323db4a5cb7b35b234f4ae0fca72a93f6562756
- SHA512 1cb81b46f383099a5cfa48b2eb1de5247bd7352af2e6c16e4a507d3edcc7e25cb936f951c450bb96996b600a3fd512e86e7c7874e8b1295acba6463ad70e0b79
- SSDEEP 98304:5fKUgTH2M2m9UMpu1QfLczqssnKSsuw6Kui+w32+QDENms2f:59gTH2qBpu1QfLIqsufsz5ui+LjENa
- TLSH T127A6292162D98FACC05FE034CE4676A566337C458F21AFDF19847E293E726A05E3921F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with ASPack
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application