General
- Target 2026-06-04_64b32fcbb466b0907836f30bb3640a46_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 5.2MB
- Sample260604-ejnlgshx3y
- SHA256 f771a802e4e84ccbd428811e60f9f1befe237f55a7b0450efaddce5c876dd9ed
- MD5 64b32fcbb466b0907836f30bb3640a46
- SHA1 9aeba53fc306c5512e6368aef24c6f7a7ce78767
- SHA512 79220bc60e0f105c6a519aea4003d74cb4755a2884141f54ef67b14238900015fe9b5616f0ff10c449c1c67dcc56e93a33a4f5b7503493ba2aa9ae193f86deda
- SSDEEP 49152:wabH/HI1zZPItx2apeapelh+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nk4:9I1etUvlc0oAaldmdmnpEwLapI9
- TLSH T11B464B23B19204A9D189D075DF06C23197A17C6D8BF1A2FB369076D93F72AD03B3971A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-04_64b32fcbb466b0907836f30bb3640a46_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_64b32fcbb466b0907836f30bb3640a46_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win11-20260513-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-04_64b32fcbb466b0907836f30bb3640a46_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 5.2MB
- SHA256 f771a802e4e84ccbd428811e60f9f1befe237f55a7b0450efaddce5c876dd9ed
- MD5 64b32fcbb466b0907836f30bb3640a46
- SHA1 9aeba53fc306c5512e6368aef24c6f7a7ce78767
- SHA512 79220bc60e0f105c6a519aea4003d74cb4755a2884141f54ef67b14238900015fe9b5616f0ff10c449c1c67dcc56e93a33a4f5b7503493ba2aa9ae193f86deda
- SSDEEP 49152:wabH/HI1zZPItx2apeapelh+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nk4:9I1etUvlc0oAaldmdmnpEwLapI9
- TLSH T11B464B23B19204A9D189D075DF06C23197A17C6D8BF1A2FB369076D93F72AD03B3971A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10Grants admin privileges
Uses net.exe to modify the user's privileges.
Disables service(s)
Executes dropped EXE
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1