General
- Target 2026-06-08_47990f92fd5c4aa4da4bcbdc90149ece_cobalt-strike_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 1.0MB
- Sample260608-sgms3agv71
- SHA256 c211461f4bcac8269cd0cd7953501a397f5549cee679c020a34ac313c9f6adea
- MD5 47990f92fd5c4aa4da4bcbdc90149ece
- SHA1 ca3a2b48d9231fdaccb129496f34d72113ba59e5
- SHA512 b480495f9597cfc2ce73a75fb21ffc72d7cdfc37dbf2ce90491c0846229eb5a2b3ac7e8a741c60c50802818547dc0002423aa42db5ea1976e854101e397cb224
- SSDEEP 12288:P4Ryed8I7r/7mmUh6bi9I6VN4Ryed8I7r/7m6Q6biX6D+k3HVJ5h1n:P4R5CIH/7IIyN4R5CIH/7TUIJVJT1n
- TLSH T18135B6B26501A62AF514FE73C75FB72878207EA61CD1850EDA0E772C55381F26FB2389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-08_47990f92fd5c4aa4da4bcbdc90149ece_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-08_47990f92fd5c4aa4da4bcbdc90149ece_cobalt-strike_elex_hijackloader_redline-stealer_rhadaman.exe
Resource
win11-20260513-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-08_47990f92fd5c4aa4da4bcbdc90149ece_cobalt-strike_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 1.0MB
- SHA256 c211461f4bcac8269cd0cd7953501a397f5549cee679c020a34ac313c9f6adea
- MD5 47990f92fd5c4aa4da4bcbdc90149ece
- SHA1 ca3a2b48d9231fdaccb129496f34d72113ba59e5
- SHA512 b480495f9597cfc2ce73a75fb21ffc72d7cdfc37dbf2ce90491c0846229eb5a2b3ac7e8a741c60c50802818547dc0002423aa42db5ea1976e854101e397cb224
- SSDEEP 12288:P4Ryed8I7r/7mmUh6bi9I6VN4Ryed8I7r/7m6Q6biX6D+k3HVJ5h1n:P4R5CIH/7IIyN4R5CIH/7TUIJVJT1n
- TLSH T18135B6B26501A62AF514FE73C75FB72878207EA61CD1850EDA0E772C55381F26FB2389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1