General
- Target 2026-05-10_ef0ed1444f126b61dd70585fb06f628b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 7.9MB
- Sample260510-txk5vae16r
- SHA256 9477ff58bb83fcd61f9cba60181871b86a27ea239348ac3e8fe9e864d4272d13
- MD5 ef0ed1444f126b61dd70585fb06f628b
- SHA1 0d02f993e92bf330d71e8e4e2211a6a505d5f9bf
- SHA512 16d8b61ef256047ebb85314cd5d1a60715ac85cec35fba5b8c687ce350181b87c46ba7a3deb5e27da4e78ac13a41c9bd14ed74526685443f8af4c9c745d2ff74
- SSDEEP 98304:RIyC0oAaldmdmnp7KUDIyC0oAaldmdmnp7KUp:bnKmd0nFnKmd0np
- TLSH T199863913A14654ACF149D875CF0AE635AB207C8A07F164FF7684B6E53A76AF03B39306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-10_ef0ed1444f126b61dd70585fb06f628b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win10v2004-20260130-en
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-10_ef0ed1444f126b61dd70585fb06f628b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win11-20260130-en
18 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-10_ef0ed1444f126b61dd70585fb06f628b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 7.9MB
- SHA256 9477ff58bb83fcd61f9cba60181871b86a27ea239348ac3e8fe9e864d4272d13
- MD5 ef0ed1444f126b61dd70585fb06f628b
- SHA1 0d02f993e92bf330d71e8e4e2211a6a505d5f9bf
- SHA512 16d8b61ef256047ebb85314cd5d1a60715ac85cec35fba5b8c687ce350181b87c46ba7a3deb5e27da4e78ac13a41c9bd14ed74526685443f8af4c9c745d2ff74
- SSDEEP 98304:RIyC0oAaldmdmnp7KUDIyC0oAaldmdmnp7KUp:bnKmd0nFnKmd0np
- TLSH T199863913A14654ACF149D875CF0AE635AB207C8A07F164FF7684B6E53A76AF03B39306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10Grants admin privileges
Uses net.exe to modify the user's privileges.
Drops file in Drivers directory
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Disables service(s)
Executes dropped EXE
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1