General
- Target 2026-05-28_553cd096fe2eb222e89319bead36a308_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 9.8MB
- Sample260528-ryblpacv6x
- SHA256 636cbd7c2e16bf9cdd4e27b8675e7b01f60c8063dae74c097de262898e8d85d5
- MD5 553cd096fe2eb222e89319bead36a308
- SHA1 56f6616415fc8443681747afffe4a981559eaada
- SHA512 10a918154dfc319e9ede13937179e0e714fcf9169ee449484da8411f852d69dbbc785ccd4b7ceace5373ef12596eb37db6ca7c7f3ca4b5924e25006cc0562431
- SSDEEP 98304:vI1Bg4WQtZ/K0tGOFWVRuLftCTDI1Bg4WQtZ/K0tGOFWVRuLftCTt:OPWyZ/K0ttYVAATiPWyZ/K0ttYVAATt
- TLSH T1D6A65B13F6E940E9E0AAD174DF358621AB727C694BF1A5DF324032D41E72AD07B38726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-28_553cd096fe2eb222e89319bead36a308_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-28_553cd096fe2eb222e89319bead36a308_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win11-20260513-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-05-28_553cd096fe2eb222e89319bead36a308_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 9.8MB
- SHA256 636cbd7c2e16bf9cdd4e27b8675e7b01f60c8063dae74c097de262898e8d85d5
- MD5 553cd096fe2eb222e89319bead36a308
- SHA1 56f6616415fc8443681747afffe4a981559eaada
- SHA512 10a918154dfc319e9ede13937179e0e714fcf9169ee449484da8411f852d69dbbc785ccd4b7ceace5373ef12596eb37db6ca7c7f3ca4b5924e25006cc0562431
- SSDEEP 98304:vI1Bg4WQtZ/K0tGOFWVRuLftCTDI1Bg4WQtZ/K0tGOFWVRuLftCTt:OPWyZ/K0ttYVAATiPWyZ/K0ttYVAATt
- TLSH T1D6A65B13F6E940E9E0AAD174DF358621AB727C694BF1A5DF324032D41E72AD07B38726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1