futurax | 2026-10-16_e538b4f0935b59a50cf93c2bce59d54b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee_vidar_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_e538b4f0935b59a50cf93c2bce59d54b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee_vidar_wannacry
Size 12.4MB
Sample261017-e1ls8ahy4t
SHA256 97a38a77acd304d8effaff9b479ea4910873a7989260645f400a60bcb7afce91
MD5 e538b4f0935b59a50cf93c2bce59d54b
SHA1 bb21a7bcd328c662de8c6fcb7cf97c2beb3ce34e
SHA512 21b134a447bf5678f70881dc8f034159d5da9deb83a04231530beff544c72220378217885068c2b81258862d95c38c6b33918dcda94cc826ff5903a21c0b9d85
SSDEEP 98304:UoSPIyq2fwIabjKoh9Ws0E2YFGOTLapISd7TIOSAadfWQtZ/K0tGOFWVRuLftCTC:VS5X01cISd7TfGdfWyZ/K0ttYVAATLo/
TLSH
T112D66C13B2E40465E06AD279CF61862597B27C298BF296DF31407ADD2E73BC07736722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm futurax

Malware Config

Signatures

Family: Futurax
Futurax is a Windows worm written in Delphi.
worm futurax

Detects Futurax 1 IoCs

resource	yara_rule
sample	family_futurax

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables packed with MEW 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_MEW

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_e538b4f0935b59a50cf93c2bce59d54b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee_vidar_wannacry

File Explorer

2026-10-16_e538b4f0935b59a50cf93c2bce59d54b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee_vidar_wannacry

.exe 12.4MB

2026-10-16_e538b4f0935b59a50cf93c2bce59d54b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stop_tofsee_vidar_wannacry

SHA256 97a38a77acd304d8effaff9b479ea4910873a7989260645f400a60bcb7afce91
MD5 e538b4f0935b59a50cf93c2bce59d54b
SHA1 bb21a7bcd328c662de8c6fcb7cf97c2beb3ce34e
SHA512 21b134a447bf5678f70881dc8f034159d5da9deb83a04231530beff544c72220378217885068c2b81258862d95c38c6b33918dcda94cc826ff5903a21c0b9d85
SSDEEP 98304:UoSPIyq2fwIabjKoh9Ws0E2YFGOTLapISd7TIOSAadfWQtZ/K0tGOFWVRuLftCTC:VS5X01cISd7TfGdfWyZ/K0ttYVAATLo/
TLSH
T112D66C13B2E40465E06AD279CF61862597B27C298BF296DF31407ADD2E73BC07736722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Futurax
Detects executables containing URLs to raw contents of a Github gist
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables packed with MEW
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths