General
- Target 2026-06-01_94782d39d3035b660c872e16339d7dad_cobalt-strike_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 790KB
- Sample260601-e51syact6t
- SHA256 c68626f4ea331b09d3d4cbbc055218fb1de127e556c89197049d8e9ea1e5df24
- MD5 94782d39d3035b660c872e16339d7dad
- SHA1 58e9bce412a742ca6bd83d4945036080be56825a
- SHA512 bdbedb102309f38fb5a5150bac59b1c21558a2b518204800f3af18ba6a3b6c56fd2457f05da292eec0237f12405abab021779cb655e40ed6ea289964ce97d755
- SSDEEP 12288:w4Ryed8I7r/7mWUn6bi9I6SzkDnaxOBlyO1UdWXkiL1fh7NhO0ZUDIhUWcRGJlFu:w4R5CIH/7aI144cydWXkG20GSJcMJlY
- TLSH T132055A12679440A9E1739634A8A59512EB367D310B609FCF63D0732E1E327D2BF78B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-01_94782d39d3035b660c872e16339d7dad_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-01_94782d39d3035b660c872e16339d7dad_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe
Resource
win11-20260513-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-01_94782d39d3035b660c872e16339d7dad_cobalt-strike_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 790KB
- SHA256 c68626f4ea331b09d3d4cbbc055218fb1de127e556c89197049d8e9ea1e5df24
- MD5 94782d39d3035b660c872e16339d7dad
- SHA1 58e9bce412a742ca6bd83d4945036080be56825a
- SHA512 bdbedb102309f38fb5a5150bac59b1c21558a2b518204800f3af18ba6a3b6c56fd2457f05da292eec0237f12405abab021779cb655e40ed6ea289964ce97d755
- SSDEEP 12288:w4Ryed8I7r/7mWUn6bi9I6SzkDnaxOBlyO1UdWXkiL1fh7NhO0ZUDIhUWcRGJlFu:w4R5CIH/7aI144cydWXkG20GSJcMJlY
- TLSH T132055A12679440A9E1739634A8A59512EB367D310B609FCF63D0732E1E327D2BF78B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1