General
- Target 2026-05-08_f7f48dca34a107ea629820e1d4651d0a_cobalt-strike_elex_glassworm_icedid_njrat_stealc_swisyn_vidar
- Size 1.3MB
- Sample260508-t7fccaa12w
- SHA256 d4b1c2232fb29c6371b91c809f72a9f7b33081977393c089ec73059424608183
- MD5 f7f48dca34a107ea629820e1d4651d0a
- SHA1 d5152b96307b1eb8153329084f659cee00104612
- SHA512 48d6d48c242d7594262092f19ee70c1200718521a29eedabc4ba6dccd49d2122a67938f81dbe9a1271813eeea3491c36e727d63d04baa7b48a7855ff40851327
- SSDEEP 24576:cFOapo4fg5CFWYii0zRZw2mX0M/wnVKz+zAz:sto4fAtYi3tZQtYACW
- TLSH T133558C2A665800E9D577C075C9518A0FF6F27C1A07A09BDF23A0B7672F336D52E7A312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-08_f7f48dca34a107ea629820e1d4651d0a_cobalt-strike_elex_glassworm_icedid_njrat_stealc_swisyn_vidar.exe
Resource
win10v2004-20260130-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-08_f7f48dca34a107ea629820e1d4651d0a_cobalt-strike_elex_glassworm_icedid_njrat_stealc_swisyn_vidar.exe
Resource
win11-20260130-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-08_f7f48dca34a107ea629820e1d4651d0a_cobalt-strike_elex_glassworm_icedid_njrat_stealc_swisyn_vidar
- Size 1.3MB
- SHA256 d4b1c2232fb29c6371b91c809f72a9f7b33081977393c089ec73059424608183
- MD5 f7f48dca34a107ea629820e1d4651d0a
- SHA1 d5152b96307b1eb8153329084f659cee00104612
- SHA512 48d6d48c242d7594262092f19ee70c1200718521a29eedabc4ba6dccd49d2122a67938f81dbe9a1271813eeea3491c36e727d63d04baa7b48a7855ff40851327
- SSDEEP 24576:cFOapo4fg5CFWYii0zRZw2mX0M/wnVKz+zAz:sto4fAtYi3tZQtYACW
- TLSH T133558C2A665800E9D577C075C9518A0FF6F27C1A07A09BDF23A0B7672F336D52E7A312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory