General
- Target 2026-06-27_ce8feb8ecddaaf32290efff52146b876_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar
- Size 5.2MB
- Sample260629-c8mpdabw3v
- SHA256 ab1b9d36a82a654cd210fd55994dd8e3b0fa64584618316c18fe974a9a04216d
- MD5 ce8feb8ecddaaf32290efff52146b876
- SHA1 1cc623b251b4a990e59f06c987037a1bca46f257
- SHA512 7467f69d7b6f9c0c71c9dccf17aec61f75e4867c9ce4e7adcb8df56f69b897123ae20d68856f0496e63156d55406a4bda9c6ea62f7706578f50ef2035382f0b4
- SSDEEP 49152:wabH/yabH/ZfuyRJRRJVabH/dYabH/ZfuyRJRRJvtTToonbXaIHy5B+Cq99LyHHg:TZR/RmZR/Rx/nbXaP80oAaldmdmnpR
- TLSH T1B8464A13B29444E9D056C074CE558129E7227C6947F2AAEF33807AD93FB3AD07B39726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_ce8feb8ecddaaf32290efff52146b876_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_ce8feb8ecddaaf32290efff52146b876_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
Resource
win11ltsc2024-20260617-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-27_ce8feb8ecddaaf32290efff52146b876_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar
- Size 5.2MB
- SHA256 ab1b9d36a82a654cd210fd55994dd8e3b0fa64584618316c18fe974a9a04216d
- MD5 ce8feb8ecddaaf32290efff52146b876
- SHA1 1cc623b251b4a990e59f06c987037a1bca46f257
- SHA512 7467f69d7b6f9c0c71c9dccf17aec61f75e4867c9ce4e7adcb8df56f69b897123ae20d68856f0496e63156d55406a4bda9c6ea62f7706578f50ef2035382f0b4
- SSDEEP 49152:wabH/yabH/ZfuyRJRRJVabH/dYabH/ZfuyRJRRJvtTToonbXaIHy5B+Cq99LyHHg:TZR/RmZR/Rx/nbXaP80oAaldmdmnpR
- TLSH T1B8464A13B29444E9D056C074CE558129E7227C6947F2AAEF33807AD93FB3AD07B39726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1