General
- Target 2026-07-02_16b6b208fed64f7c2ebe57b94d3d59c3_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 8.5MB
- Sample260702-wxedeabx4y
- SHA256 95e1e225e82f047ab0d60748fce5110f98cbbfec6d23b6a983f6b5336f7864e9
- MD5 16b6b208fed64f7c2ebe57b94d3d59c3
- SHA1 2d0517683d8046db9d3a7fc4b7a29df25076231b
- SHA512 63910ad8d1fb76c6d7d6399315d91d077f9bf5e5c6478eb8404f8360b0cc94091dee9b57df3c7ef28cbd9deeedbbb4dc36daa770d0f8cc3549f66fb03f7bc27a
- SSDEEP 98304:iIyaLg2IyaLg2WQtZ/K0tGOFWVRuLftCTR0oAaldmdmnpd:yoEWyZ/K0ttYVAATmKmd0v
- TLSH T13C964913B19540A9F059E976CF2AB331AB217C594FF1A5EF724436D82A36AF03B38351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-02_16b6b208fed64f7c2ebe57b94d3d59c3_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win10v2004-20260513-en
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_16b6b208fed64f7c2ebe57b94d3d59c3_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win11ltsc2024-20260629-en
18 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-02_16b6b208fed64f7c2ebe57b94d3d59c3_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 8.5MB
- SHA256 95e1e225e82f047ab0d60748fce5110f98cbbfec6d23b6a983f6b5336f7864e9
- MD5 16b6b208fed64f7c2ebe57b94d3d59c3
- SHA1 2d0517683d8046db9d3a7fc4b7a29df25076231b
- SHA512 63910ad8d1fb76c6d7d6399315d91d077f9bf5e5c6478eb8404f8360b0cc94091dee9b57df3c7ef28cbd9deeedbbb4dc36daa770d0f8cc3549f66fb03f7bc27a
- SSDEEP 98304:iIyaLg2IyaLg2WQtZ/K0tGOFWVRuLftCTR0oAaldmdmnpd:yoEWyZ/K0ttYVAATmKmd0v
- TLSH T13C964913B19540A9F059E976CF2AB331AB217C594FF1A5EF724436D82A36AF03B38351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1