General
- Target 2026-07-05_6938130f9b1e7957b714c2cd1691a774_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 1.3MB
- Sample260705-tkw2ksdx5t
- SHA256 ebda4d297ebb252a9305d6bc10943c209834b10e010d13fbf1e17fc363d1d6a5
- MD5 6938130f9b1e7957b714c2cd1691a774
- SHA1 128e3010943b5cebf79690037bf5aef76db61a32
- SHA512 2cd9ace8d2c1189b4fd3eaf0fc26220b8515482a5884d612bd4785f00a4557acde505319cbfe4529002cd3d4f8bf3682c3f9d5598a523e84811c3daa70fd44f6
- SSDEEP 24576:w4R5CIH/7UI1niGnB9umZnb0uOrturgYp5y:wabH/II1Ffu6kturNp5y
- TLSH T198558D52AA4029FAD801C13464735553B5A43E280751FADF93ECBB363E72BC22F78796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-05_6938130f9b1e7957b714c2cd1691a774_elex_hijackloader_icedid_njrat_redline-stealer_rhadamant.exe
Resource
win10v2004-20260513-en
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_6938130f9b1e7957b714c2cd1691a774_elex_hijackloader_icedid_njrat_redline-stealer_rhadamant.exe
Resource
win11ltsc2024-20260629-en
18 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-05_6938130f9b1e7957b714c2cd1691a774_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 1.3MB
- SHA256 ebda4d297ebb252a9305d6bc10943c209834b10e010d13fbf1e17fc363d1d6a5
- MD5 6938130f9b1e7957b714c2cd1691a774
- SHA1 128e3010943b5cebf79690037bf5aef76db61a32
- SHA512 2cd9ace8d2c1189b4fd3eaf0fc26220b8515482a5884d612bd4785f00a4557acde505319cbfe4529002cd3d4f8bf3682c3f9d5598a523e84811c3daa70fd44f6
- SSDEEP 24576:w4R5CIH/7UI1niGnB9umZnb0uOrturgYp5y:wabH/II1Ffu6kturNp5y
- TLSH T198558D52AA4029FAD801C13464735553B5A43E280751FADF93ECBB363E72BC22F78796
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1