General
- Target 2026-06-28_9bba5ae8968ce7f17c89b5dc53fe24c4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar
- Size 6.9MB
- Sample260628-y47dwadv3v
- SHA256 668a2827a755a55161a4757d076b2b54ce9460c7b8106927fcf689dee011ea06
- MD5 9bba5ae8968ce7f17c89b5dc53fe24c4
- SHA1 0ffd6c3e475087880ab0986b85606428d4ad1551
- SHA512 c26880b67c55e8a194d722edc35697cd7b2fb86e6bd662175c1e701bc37d92809e09bd2e51e3222b345e199b59c961d7a190954ab402c8dcd35fb93c517b0138
- SSDEEP 98304:Pa7IwSR5WQtZ/K0tGOFWVRuLftCTtLapI9:NrWyZ/K0ttYVAATtcI9
- TLSH T157766C13B2E500A9E1AAD174DF2583319BB27C698BF1A6EF314072D51F72AD07B38716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-28_9bba5ae8968ce7f17c89b5dc53fe24c4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_9bba5ae8968ce7f17c89b5dc53fe24c4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260618-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_9bba5ae8968ce7f17c89b5dc53fe24c4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar
- Size 6.9MB
- SHA256 668a2827a755a55161a4757d076b2b54ce9460c7b8106927fcf689dee011ea06
- MD5 9bba5ae8968ce7f17c89b5dc53fe24c4
- SHA1 0ffd6c3e475087880ab0986b85606428d4ad1551
- SHA512 c26880b67c55e8a194d722edc35697cd7b2fb86e6bd662175c1e701bc37d92809e09bd2e51e3222b345e199b59c961d7a190954ab402c8dcd35fb93c517b0138
- SSDEEP 98304:Pa7IwSR5WQtZ/K0tGOFWVRuLftCTtLapI9:NrWyZ/K0ttYVAATtcI9
- TLSH T157766C13B2E500A9E1AAD174DF2583319BB27C698BF1A6EF314072D51F72AD07B38716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1