2026-05-24_370b3a5bb85f79e09efa20199eca2946_cobalt-strike_elex_hijackloader_icedid_mespinoza_vidar

General

Target
2026-05-24_370b3a5bb85f79e09efa20199eca2946_cobalt-strike_elex_hijackloader_icedid_mespinoza_vidar
Size 1.8MB
Sample260524-sd2stagv5j
SHA256 a7ee3e1ca262dea2e16da75bb440d7475b99c94c1e78bca03dd112d946ed9a2f
MD5 370b3a5bb85f79e09efa20199eca2946
SHA1 d9ee17ad3c037aa641dd7a0169d54f8acea7f5c7
SHA512 36ee5f33587147258cad06ddc1ee607f634a5b0f084196abccac7fcd4691518c14b817cbdd9982db83a77c206fae8912a04dea0cecfd517c124f08086d7853ff
SSDEEP 49152:O35DMnCIjtAyf2RAR5FeA6w24zIAOjJTe:B55vMM
TLSH
T183854B21A6B442EDE9B76534C567A536E271BD111B30F28F225CEB492F33E80E93B711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-24_370b3a5bb85f79e09efa20199eca2946_cobalt-strike_elex_hijackloader_icedid_mespinoza_vidar

File Explorer

2026-05-24_370b3a5bb85f79e09efa20199eca2946_cobalt-strike_elex_hijackloader_icedid_mespinoza_vidar

.exe 1.8MB

2026-05-24_370b3a5bb85f79e09efa20199eca2946_cobalt-strike_elex_hijackloader_icedid_mespinoza_vidar

SHA256 a7ee3e1ca262dea2e16da75bb440d7475b99c94c1e78bca03dd112d946ed9a2f
MD5 370b3a5bb85f79e09efa20199eca2946
SHA1 d9ee17ad3c037aa641dd7a0169d54f8acea7f5c7
SHA512 36ee5f33587147258cad06ddc1ee607f634a5b0f084196abccac7fcd4691518c14b817cbdd9982db83a77c206fae8912a04dea0cecfd517c124f08086d7853ff
SSDEEP 49152:O35DMnCIjtAyf2RAR5FeA6w24zIAOjJTe:B55vMM
TLSH
T183854B21A6B442EDE9B76534C567A536E271BD111B30F28F225CEB492F33E80E93B711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

177464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Office\Target\x86\ship\postc2r\x-none\clview.pdb

Name

.text

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

280B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-24_370b3a5bb85f79e09efa20199eca2946_cobalt-strike_elex_hijackloader_icedid_mespinoza_vidar

generic