0f9a8f14660021c88fd83c931034a3445121b3a0cce2a520958a9e11a2b9eadd

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_ac56ee77a879bae3fac8eb6520a8bd65_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Size 628KB
Sample260604-tmsryabs8m
SHA256 0f9a8f14660021c88fd83c931034a3445121b3a0cce2a520958a9e11a2b9eadd
MD5 ac56ee77a879bae3fac8eb6520a8bd65
SHA1 4fdba45151ad22fa9dbb850b799c80707a18068c
SHA512 e966477694e3db6248e7252ffba27ca32163691dd3e26bcef51f0934766c64cee32a7af26bcbd871bb6073792e67c362405c84501c4378314b71bd6b7a665f16
SSDEEP 12288:27+abaH91qiMmmDhu9sx/RElA0iW6YoFdr1vhJizNPoCNsKLQdxG:27LsqiMmmDhu9sx/RElA0iW6hBhJiRHT
TLSH
T182D48D1AB7D401F9E07BD138C8929666F7B1740617308B9F13A0467B2F676A19F3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5412	Logo1_.exe
2368	2026-06-04_ac56ee77a879bae3fac8eb6520a8bd65_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\it-it\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\0.2.2\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\IwaKeyDistribution\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib-commonjs\transforms\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\sk-sk\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\WinMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pt-br\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-si\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\es-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\Images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\eu-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{801B79ED-F2FF-4982-A51E-9DE43565C5B5}\MicrosoftEdge_X64_139.0.3405.125.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\it-IT\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.OneDriveSync_21220.1024.5.0_neutral__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_proxy\win10\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lt\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_~_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ro-ro\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\Crashpad\reports\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sq\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Logo1_.exe	2026-06-04_ac56ee77a879bae3fac8eb6520a8bd65_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe
File created	C:\Windows\rundl132.exe	2026-06-04_ac56ee77a879bae3fac8eb6520a8bd65_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_ac56ee77a879bae3fac8eb6520a8bd65_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe
5412	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5592 wrote to memory of 2112	5592	2026-06-04_ac56ee77a879bae3fac8eb6520a8bd65_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	80
PID 5592 wrote to memory of 5412	5592	2026-06-04_ac56ee77a879bae3fac8eb6520a8bd65_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe	81
PID 5412 wrote to memory of 1652	5412	Logo1_.exe	82
PID 1652 wrote to memory of 920	1652	net.exe	85
PID 2112 wrote to memory of 2368	2112	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-06-04_ac56ee77a879bae3fac8eb6520a8bd65_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_ac56ee77a879bae3fac8eb6520a8bd65_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEF.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Users\Admin\AppData\Local\Temp\2026-06-04_ac56ee77a879bae3fac8eb6520a8bd65_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_ac56ee77a879bae3fac8eb6520a8bd65_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"
    3⤵
    - Executes dropped EXE
    PID:2368
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 9dd23b5e59eeb038cce7f44aba18d4034ca0fa09efe0e5d7cb8c76f4f93d94ae
MD5 9c747ad78df453218bc62f5fd0e6ea48
SHA1 3deb55dc28b1e063b2ce2680b2bfa2cfcad04017
SHA512 1ef4aeca2de468b26e2c310d41d4c8c1d8ec086f3ab9640813f9e9c6bef7b807ff77290c80f9eff55c31b6674e297b280e8a276e377a812710a1666abd1eda51
SSDEEP 3072:GWftffjmNyYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:PVfjmNyYCk3ET+Tu3fCUzB+JHI
TLSH
T10FC39C1375D1C472E4B2593109A1EE718A3EFD620A50DE6B33D41A3E0F316C1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StopConvertTo.exe

Path C:\Program Files\StopConvertTo.exe
Size 145KB
SHA256 e10d7a309bdb493b71fe7a3bcbe85fdcda6ca31bfa7157e4afa98ee2d50d19a0
MD5 8c67d6a9f00134b7927fc8eaef4da0b2
SHA1 fe8fcc345ac217c39e66aa7777db88de12f2e16a
SHA512 428b05375a020fc93a1d3ea4bebf947e74ae4a9a610da1e438dce9233c9f2873af7343af485fd30ad7469faf178d74bebe07dbc3d3a142f79ae203531b61418d
SSDEEP 3072:RWftffjmNcknQ2OoY0eUfsbgp7lWGec8ADaQszWIYcecJJ7b:0VfjmNckQDoYOsbgx2czpeYkb
TLSH
T1DAE312E61CF68C72D5579A7CEDA443308227863E2E0E93757952513BA2F4B7D121307B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$aEEF.bat

Path C:\Users\Admin\AppData\Local\Temp\$$aEEF.bat
Size 961B
SHA256 c84c1bea79e11df683ac5367c0eb719ad4dfad39dc572b8592463b666f2c1dd4
MD5 e4fc001f3183115518523c313d9e9525
SHA1 435d6233dc77caeb0e098ee48542b1723b8d65b1
SHA512 17018926086df5e62ff6c068b6f338d5884eb5df5462935dea71add9202c101a7e639e4d33fe2a575e25e3e68172e435b9eb48688ea10e0f1aca69634ff1ed0f
TLSH
T11811B611CDB6CBE8A865607286625C988065AE6EBF453331A72CCC8F50E9C5FFDD1712
MD5 SHA1 SHA512 TLSH

Submit Download

2026-06-04_ac56ee77a879bae3fac8eb6520a8bd65_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-04_ac56ee77a879bae3fac8eb6520a8bd65_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Size 601KB
SHA256 e58fcb38e152b7d76551e6b056ff407bf183f02417a9c0033f36c92e094af300
MD5 2f9c5e16f49fae9a154b58b17eaf9c13
SHA1 8f2e86438e8599317b82f72339d794158a60f959
SHA512 4ed39119f74c2b7248ec8184bcbecffba7b314794914f77df32c244ffbd0f04f94dc436f0fd0413add102f31edae35d58913e0db1d8a69d625a5d7bd362a36e3
SSDEEP 12288:2baH91qiMmmDhu9sx/RElA0iW6YoFdr1vhJizNPoCNsKLQdxG:2sqiMmmDhu9sx/RElA0iW6hBhJiRHs/G
TLSH
T1F3D48D1AB79401F9E07BD138C8929666F7B174061B308B9F43A0467B2F776A19F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 3e57ba6d6950b098b99e5777f641df1987ab7c3b40ced56d26842d264f3e208b
MD5 feffcd942888cc89495bffba14d082c7
SHA1 d38488b491c2337a3927ba05457b2bfabbfff4eb
SHA512 8158b04808551aa8518f7a326dce1e9ec90eaa19a53d69dbf24d822e10ec096cd46816f96a0c3e30eaafd8a2e974c722bd34b3fce4e06aea5e5aff2ea225e4f9
SSDEEP 768:RM1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:RWfgLdQAQfcfymN
TLSH
T1A5C2F1BA12CD5A34F86548BDDFE31701C33C877A059F59A539B19D3B3254B68200FA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-2746394149-3500112804-1243524366-1000\_desktop.ini
Size 8B
SHA256 055ea376e2004e4bba4864f8580ed635e094eb2dded0034a71189c056021dad9
MD5 2f4a1f0fa04a55f8ce91a6bd1ca42ff3
SHA1 63b897dffe8c5c30b66a5d3288269a0cc51d444c
SHA512 c60f3c126f620affacb594e7729fcb10a604c00b94be12a51b41dd10d0aa0bbfbf86aa58534a86d1fb9ff22579b22d6db87ee065ff35d0ede612774564c043e5
MD5 SHA1 SHA512

Submit Download

memory/5412-28-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5412-34-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5412-38-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5412-21-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5412-519-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5412-1226-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5412-5007-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5412-10-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5412-5504-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5592-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5592-9-0x0000000000400000-0x0000000000434000-memory.dmp

Download