2026-05-10_091a5217e3bc054a51d9ae603826248c_cobalt-strike_elex_hijackloader_icedid_mespinoza_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-10_091a5217e3bc054a51d9ae603826248c_cobalt-strike_elex_hijackloader_icedid_mespinoza_njrat_vidar
Size 1.0MB
Sample260510-mt72wagy6k
SHA256 3bb6722de280463afa627115b131bdbe3d73e77af562db950ada3524f870b99b
MD5 091a5217e3bc054a51d9ae603826248c
SHA1 0559a7d2e61d6e79c9c10bcde2e54b4749926454
SHA512 6599b8991f242e5155efca6c3283c45b8d256ca2f7120bc4c3dc21b5f5c4e1b718286f821ca9ba85de97af30ef715ef39196c64e276019cf805d088b29cf127d
SSDEEP 12288:D1aYeiveC8omNZHsyClgmw6zxV7ED3JeU7vinrmuZE+9x9X7gefoZcLF/ynQD:Xw/rND5TvinrmWE+9xYcLP
TLSH
T13B353A127594DA69C46F86B899158BF6E9377E121F209BC727C03E6D3F336828835327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-10_091a5217e3bc054a51d9ae603826248c_cobalt-strike_elex_hijackloader_icedid_mespinoza_njrat_vidar

File Explorer

2026-05-10_091a5217e3bc054a51d9ae603826248c_cobalt-strike_elex_hijackloader_icedid_mespinoza_njrat_vidar

.exe 1.0MB

2026-05-10_091a5217e3bc054a51d9ae603826248c_cobalt-strike_elex_hijackloader_icedid_mespinoza_njrat_vidar

IMPHASH 286f72003d945e10bc4564c5a22c2246
SHA256 3bb6722de280463afa627115b131bdbe3d73e77af562db950ada3524f870b99b
MD5 091a5217e3bc054a51d9ae603826248c
SHA1 0559a7d2e61d6e79c9c10bcde2e54b4749926454
SHA512 6599b8991f242e5155efca6c3283c45b8d256ca2f7120bc4c3dc21b5f5c4e1b718286f821ca9ba85de97af30ef715ef39196c64e276019cf805d088b29cf127d
SSDEEP 12288:D1aYeiveC8omNZHsyClgmw6zxV7ED3JeU7vinrmuZE+9x9X7gefoZcLF/ynQD:Xw/rND5TvinrmWE+9xYcLP
TLSH
T13B353A127594DA69C46F86B899158BF6E9377E121F209BC727C03E6D3F336828835327
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21661

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

P:\Target\x86\ship\licensing\x-none\ospprearm.pdb

ole32

CLSIDFromString

vcruntime140

wcsrchr _except_handler4_common __vcrt_InitializeCriticalSectionEx __telemetry_main_return_trigger __telemetry_main_invoke_trigger __std_exception_destroy __std_exception_copy memcpy __CxxFrameHandler3 _CxxThrowException memmove memset

msvcp140

_Thrd_id ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ

api-ms-win-crt-string-l1-1-0

strncpy_s isdigit wcsncpy_s _stricmp wcscmp wcsncat_s wcscpy_s wcscat_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __p__commode _set_fmode __acrt_iob_func

api-ms-win-crt-convert-l1-1-0

_wtol

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table terminate _controlfp_s _errno _invalid_parameter_noinfo_noreturn _invalid_parameter_noinfo _register_thread_local_exe_atexit_callback _c_exit __p___wargv __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _crt_atexit _set_app_type _seh_filter_exe _cexit

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale __initialize_lconv_for_unsigned_char

kernel32

IsWow64Process GetSystemInfo RaiseException GetCurrentProcessId GetCurrentProcess CloseHandle DeleteCriticalSection VerSetConditionMask GetLastError SetErrorMode FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW VerifyVersionInfoW MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection VirtualQuery TerminateProcess LoadLibraryExA IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent WerRegisterMemoryBlock VirtualProtect GetTickCount GetCurrentThreadId HeapSetInformation GetProcessHeap QueryPerformanceCounter GetShortPathNameA GetModuleFileNameW GetModuleFileNameA GetSystemTimeAsFileTime InitializeCriticalSectionEx

advapi32

RegCloseKey RegQueryValueExW RegGetValueW RegCreateKeyExW RegOpenKeyExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-10_091a5217e3bc054a51d9ae603826248c_cobalt-strike_elex_hijackloader_icedid_mespinoza_njrat_vidar

ole32

vcruntime140

msvcp140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

advapi32

generic