General
- Target 2026-05-19_841b7b1cf548206b0a7b1ab0e14953ac_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 3.2MB
- Sample260519-ehcslabw7j
- SHA256 795c7e9f98865b7f0b0e3485b97a383a722a62fa9dfd4fb4debb436ece566464
- MD5 841b7b1cf548206b0a7b1ab0e14953ac
- SHA1 022c3f45db8e8f35ff4ddebde3ba71a298e722d2
- SHA512 bd56dc45e194987f09f63f2ee5ade86a64151e9e9d60dceff3de79d10a38fe72e18ba5ec83e1683d0fefabb2decaac05fdd258fe6729f96e0e5779e49c9a1799
- SSDEEP 49152:wabH/6abH/2jI1Om9dsTh7IwM+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1p:2I1Ox7Iw90oAaldmdmnp
- TLSH T1C4F55A13A29544E9D156C074DE46C232EB227C6D0BF1A5FF32807ADA3A33AD17B39716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-19_841b7b1cf548206b0a7b1ab0e14953ac_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-19_841b7b1cf548206b0a7b1ab0e14953ac_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win11-20260513-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-19_841b7b1cf548206b0a7b1ab0e14953ac_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 3.2MB
- SHA256 795c7e9f98865b7f0b0e3485b97a383a722a62fa9dfd4fb4debb436ece566464
- MD5 841b7b1cf548206b0a7b1ab0e14953ac
- SHA1 022c3f45db8e8f35ff4ddebde3ba71a298e722d2
- SHA512 bd56dc45e194987f09f63f2ee5ade86a64151e9e9d60dceff3de79d10a38fe72e18ba5ec83e1683d0fefabb2decaac05fdd258fe6729f96e0e5779e49c9a1799
- SSDEEP 49152:wabH/6abH/2jI1Om9dsTh7IwM+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1p:2I1Ox7Iw90oAaldmdmnp
- TLSH T1C4F55A13A29544E9D156C074DE46C232EB227C6D0BF1A5FF32807ADA3A33AD17B39716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1