2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

General

Target
2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar
Size 2.0MB
Sample260506-txw74set9y
SHA256 453747dd29ae548eb40fec369f1fafb681ac5980f203aca990a07c2aedc177a4
MD5 6235dd79917d4732d27f84c3f2a50f3b
SHA1 38e65c3f65342ab702b57277cdeb13854eae82f6
SHA512 40deeb598bacef7f5729e0bde6cf1328e2866bd1eab6bdd846cc7f32c85234c8e63d71c1bd7416bf556f676e450ce696f33cfe777a116a2f76f7eeca993b06b2
SSDEEP 12288:EZ41TtTuRWny8d+roTfREZW9Ax3K8CbEcieT6O48OwgIk55bCu/8huoMTJ/8rov/:ftTuRWFsronbEqa6+GG8yKrO4c
TLSH
T103A58E1BB79400E8D42AC175CB654236E672BC560B30AADF06D0B3692F77AF46F3A714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

File Explorer

2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

.exe 2.0MB

2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

IMPHASH 9135dd62a76519fbb901484cd96ec33f
SHA256 453747dd29ae548eb40fec369f1fafb681ac5980f203aca990a07c2aedc177a4
MD5 6235dd79917d4732d27f84c3f2a50f3b
SHA1 38e65c3f65342ab702b57277cdeb13854eae82f6
SHA512 40deeb598bacef7f5729e0bde6cf1328e2866bd1eab6bdd846cc7f32c85234c8e63d71c1bd7416bf556f676e450ce696f33cfe777a116a2f76f7eeca993b06b2
SSDEEP 12288:EZ41TtTuRWny8d+roTfREZW9Ax3K8CbEcieT6O48OwgIk55bCu/8huoMTJ/8rov/:ftTuRWFsronbEqa6+GG8yKrO4c
TLSH
T103A58E1BB79400E8D42AC175CB654236E672BC560B30AADF06D0B3692F77AF46F3A714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaEnd __vbaFreeVarList __vbaPut3 _adj_fdiv_m64 __vbaPut4 __vbaNextEachVar _adj_fprem1 ord518 ord519 __vbaStrCat __vbaVarCmpNe __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaVarForInit __vbaExitProc ord593 ord594 __vbaOnError _adj_fdiv_m16i _adj_fdivr_m16i ord598 __vbaBoolVarNull __vbaVargVar _CIsin ord525 ord632 __vbaChkstk ord526 __vbaFileClose __vbaGenerateBoundsError ord529 __vbaGet3 __vbaGet4 __vbaVarTstEq __vbaObjVar DllFunctionCall __vbaVarOr __vbaVarLateMemSt ord670 _adj_fpatan ord600 _CIsqrt __vbaExceptHandler __vbaStrToUnicode _adj_fprem _adj_fdivr_m64 ord608 ord716 __vbaFPException __vbaInStrVar __vbaStrVarVal __vbaVarCat ord535 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaNew2 __vbaVarLateMemCallLdRf ord570 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord578 ord100 __vbaVarSetVar __vbaI4Var __vbaVarCmpEq __vbaLateMemCall __vbaVarAdd __vbaStrToAnsi __vbaVarDup ord616 __vbaFpI4 __vbaVarLateMemCallLd __vbaVarCopy __vbaVarTstGe ord617 __vbaVarSetObjAddref _CIatan __vbaStrMove __vbaForEachVar _allmul _CItan __vbaAryUnlock __vbaFPInt __vbaVarForNext _CIexp __vbaMidStmtBstr __vbaFreeObj ord580 __vbaFreeStr

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-06_6235dd79917d4732d27f84c3f2a50f3b_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

msvbvm60

generic