General
- Target 2026-06-25_7831e06cc344bcf58dff4d5432eb738e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 7.6MB
- Sample260629-1f72lsgz2n
- SHA256 c2ff96e8be01b01d0d13d5cbc382202a4be5802a3b39fde292c5aa54a286ee2a
- MD5 7831e06cc344bcf58dff4d5432eb738e
- SHA1 f4386045849b12b66fe6ba94dfec677656077202
- SHA512 29c098f5ebaabd56ad909e8ddd81ce06398b39281c38895334ae14124e0fb61cde4c03d0cec49f80c8b31ccb49f6c3d8e8ab43cf64e64544bbbab55e20cc5f9c
- SSDEEP 98304:SI1fI1VKPI1fI1VKE0oAaldmdmnp/LapIfLapIx:l+VKu+VKxKmd0lcIfcIx
- TLSH T141863A2371E144A9D1898030DF16C23597E17C798BF29AEB7240B6D93FB26D07B3971A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-25_7831e06cc344bcf58dff4d5432eb738e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-25_7831e06cc344bcf58dff4d5432eb738e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win11ltsc2024-20260629-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-25_7831e06cc344bcf58dff4d5432eb738e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 7.6MB
- SHA256 c2ff96e8be01b01d0d13d5cbc382202a4be5802a3b39fde292c5aa54a286ee2a
- MD5 7831e06cc344bcf58dff4d5432eb738e
- SHA1 f4386045849b12b66fe6ba94dfec677656077202
- SHA512 29c098f5ebaabd56ad909e8ddd81ce06398b39281c38895334ae14124e0fb61cde4c03d0cec49f80c8b31ccb49f6c3d8e8ab43cf64e64544bbbab55e20cc5f9c
- SSDEEP 98304:SI1fI1VKPI1fI1VKE0oAaldmdmnp/LapIfLapIx:l+VKu+VKxKmd0lcIfcIx
- TLSH T141863A2371E144A9D1898030DF16C23597E17C798BF29AEB7240B6D93FB26D07B3971A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1