General
- Target 2026-06-02_da191d9aaec5a56041da79e3c0d4b431_cobalt-strike_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 1.0MB
- Sample260602-wyfymact71
- SHA256 c0c84a7b443a1fe29000cee9ff83a0769622f00c5e700c112df56b71b01f68dc
- MD5 da191d9aaec5a56041da79e3c0d4b431
- SHA1 dbe1e9efd69bdca3ed0a35fbc704aa14db06f805
- SHA512 af8ec75cbef6a098e36880d025cf8f39220553dccaa64ad17a92e16b8003d768c77c97bd4d50764c8116e8b5eefb8fd1dcd7f1387baddcd129b5149f7dcc5986
- SSDEEP 12288:P4Ryed8I7r/7m46bi9I6VN4Ryed8I7r/7m6Q6biX6D+k3HVJ5h1n:P4R5CIH/7PIyN4R5CIH/7TUIJVJT1n
- TLSH T1D435B6B26501A62AF504FE77C75FB32878207EA51CD1850EEA0E772D55381F26FB2389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-02_da191d9aaec5a56041da79e3c0d4b431_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_da191d9aaec5a56041da79e3c0d4b431_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe
Resource
win11-20260513-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-02_da191d9aaec5a56041da79e3c0d4b431_cobalt-strike_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 1.0MB
- SHA256 c0c84a7b443a1fe29000cee9ff83a0769622f00c5e700c112df56b71b01f68dc
- MD5 da191d9aaec5a56041da79e3c0d4b431
- SHA1 dbe1e9efd69bdca3ed0a35fbc704aa14db06f805
- SHA512 af8ec75cbef6a098e36880d025cf8f39220553dccaa64ad17a92e16b8003d768c77c97bd4d50764c8116e8b5eefb8fd1dcd7f1387baddcd129b5149f7dcc5986
- SSDEEP 12288:P4Ryed8I7r/7m46bi9I6VN4Ryed8I7r/7m6Q6biX6D+k3HVJ5h1n:P4R5CIH/7PIyN4R5CIH/7TUIJVJT1n
- TLSH T1D435B6B26501A62AF504FE77C75FB32878207EA51CD1850EEA0E772D55381F26FB2389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1