b4fab4d71865dd96ab35d6defda1adc697326caf78ecfaf7dba71c5a77b4e4e9

General

Target
2026-06-25_3e47308a864dbf1427ea4e8fabfc97b4_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_swisyn_vidar
Size 3.9MB
Sample260629-2vw4bshs21
SHA256 b4fab4d71865dd96ab35d6defda1adc697326caf78ecfaf7dba71c5a77b4e4e9
MD5 3e47308a864dbf1427ea4e8fabfc97b4
SHA1 b9e28ae72e033cf6b14ca982c2ca620b1404219b
SHA512 7c69b789c6737a132c645d37f7beffdafc941258c46554d883da6ebccc7c3f6ac42edacb04fa677a9887546842b5838cbc998ea6331f168183951ffcb93c2feb
SSDEEP 98304:+WaWOBfKnlSXdgRgopW/r+N5op154iXEBdbwUoy60518ymXM2mGl:famnqdgyoE+noL54u2wUoylrVml3
TLSH
T1C616230AEBA401FAD473C1748CA2461BF6B27C6947709B8F33B61A492F372527D79316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-25_3e47308a864dbf1427ea4e8fabfc97b4_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_swisyn_vidar
- Size 3.9MB
- SHA256 b4fab4d71865dd96ab35d6defda1adc697326caf78ecfaf7dba71c5a77b4e4e9
- MD5 3e47308a864dbf1427ea4e8fabfc97b4
- SHA1 b9e28ae72e033cf6b14ca982c2ca620b1404219b
- SHA512 7c69b789c6737a132c645d37f7beffdafc941258c46554d883da6ebccc7c3f6ac42edacb04fa677a9887546842b5838cbc998ea6331f168183951ffcb93c2feb
- SSDEEP 98304:+WaWOBfKnlSXdgRgopW/r+N5op154iXEBdbwUoy60518ymXM2mGl:famnqdgyoE+noL54u2wUoylrVml3
- TLSH
  T1C616230AEBA401FAD473C1748CA2461BF6B27C6947709B8F33B61A492F372527D79316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery adware defense_evasion persistence privilege_escalation spyware trojan
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2