General
- Target 2026-05-03_c9e87af16ca0ed8774db7aef367f279d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 6.0MB
- Sample260503-tefseaf18l
- SHA256 746d51addff00b40c065a5657ed9c9ed8bb00e9bff2427b4761652d34481af82
- MD5 c9e87af16ca0ed8774db7aef367f279d
- SHA1 6e26855f064fd56488158a395f55bc356e5e33d9
- SHA512 27c5f0302bdf05b29e1ae001e95b7ca62fa06b711862e930e2de6aba1b41c9835315bcceb192232da92915888adfd31ccead3bb21d57c1ee0819c90c92a25fd3
- SSDEEP 49152:wabH/HabH/WNTy+fuQabH/4abH/WNTy+fud/KCGZd0qgNEf16lhulJLirHJIZ/K+:t3fWQtZ/K0tGOFWVRuLftCTxI1H
- TLSH T19B566B13F6E440E9E0AAD178DE758221AB327C654BF1A9DF324076D51E33AD07B38726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-03_c9e87af16ca0ed8774db7aef367f279d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win10v2004-20260130-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-03_c9e87af16ca0ed8774db7aef367f279d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win11-20260130-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-03_c9e87af16ca0ed8774db7aef367f279d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 6.0MB
- SHA256 746d51addff00b40c065a5657ed9c9ed8bb00e9bff2427b4761652d34481af82
- MD5 c9e87af16ca0ed8774db7aef367f279d
- SHA1 6e26855f064fd56488158a395f55bc356e5e33d9
- SHA512 27c5f0302bdf05b29e1ae001e95b7ca62fa06b711862e930e2de6aba1b41c9835315bcceb192232da92915888adfd31ccead3bb21d57c1ee0819c90c92a25fd3
- SSDEEP 49152:wabH/HabH/WNTy+fuQabH/4abH/WNTy+fud/KCGZd0qgNEf16lhulJLirHJIZ/K+:t3fWQtZ/K0tGOFWVRuLftCTxI1H
- TLSH T19B566B13F6E440E9E0AAD178DE758221AB327C654BF1A9DF324076D51E33AD07B38726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10Grants admin privileges
Uses net.exe to modify the user's privileges.
Disables service(s)
Executes dropped EXE
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1