General
- Target 2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 4.4MB
- Sample260503-sp4fsab15w
- SHA256 84b13afdbea2b770625d83a4d97c09e902cb9410830ffab51522962179e6868c
- MD5 6e1f62a9a4d732bc10fc204cf070f330
- SHA1 fadc861d54bbe4863bfadca3f78c2982918a03da
- SHA512 2ad9a78a4002f48a16992690255ffccf8f471e2d50e53e5b38e09bea2363b9affa4c506a87c36bb24297ec549ad59ea369a61440b651dc0a73ca0ba45c753283
- SSDEEP 49152:wabH/pabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6D:SdrZdrM0oAaldmdmnp8Tp9I1H
- TLSH T1E8265A13A24444AAE19AC174DE56C232EB217C6907F1A9EF33807BD53E73AD17B39706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
Resource
win10v2004-20260130-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
Resource
win11-20260130-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-03_6e1f62a9a4d732bc10fc204cf070f330_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 4.4MB
- SHA256 84b13afdbea2b770625d83a4d97c09e902cb9410830ffab51522962179e6868c
- MD5 6e1f62a9a4d732bc10fc204cf070f330
- SHA1 fadc861d54bbe4863bfadca3f78c2982918a03da
- SHA512 2ad9a78a4002f48a16992690255ffccf8f471e2d50e53e5b38e09bea2363b9affa4c506a87c36bb24297ec549ad59ea369a61440b651dc0a73ca0ba45c753283
- SSDEEP 49152:wabH/pabH/tqYfkFerP0abH/8habH/tqYfkFerPJ+Cq99LyHHI+t6O8N+ailEy6D:SdrZdrM0oAaldmdmnp8Tp9I1H
- TLSH T1E8265A13A24444AAE19AC174DE56C232EB217C6907F1A9EF33807BD53E73AD17B39706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1