General
- Target 2026-07-05_52686de3c63bc10873f2c02763ccb1da_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 11.2MB
- Sample260705-tmp12shv7k
- SHA256 e096423cf3457a96b673cc5d012f4d44843661a0fbdcd56c890f1489acd11228
- MD5 52686de3c63bc10873f2c02763ccb1da
- SHA1 7022646d67493cf990a2662bbc716bd8f662282a
- SHA512 6195e5e837d64ea41214b1bcfa803b78a4d15305ca0a034df836a95a5fe3d6e1bc6299e6f665e603e493602fb043c806ba743265bee2818f3fd62207a02ab4c5
- SSDEEP 196608:cFDlRFDlRFDlRFDltFDlRFDlRFDlRFDlzWyZ/K0ttYVAATW:KpppRpppwyZ/K0ttYZTW
- TLSH T1BAC67D17B29440F9E866D138CE719222EA317C2547F1E9CF239076A92F736D17B38726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-05_52686de3c63bc10873f2c02763ccb1da_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_52686de3c63bc10873f2c02763ccb1da_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win11ltsc2024-20260629-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-05_52686de3c63bc10873f2c02763ccb1da_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 11.2MB
- SHA256 e096423cf3457a96b673cc5d012f4d44843661a0fbdcd56c890f1489acd11228
- MD5 52686de3c63bc10873f2c02763ccb1da
- SHA1 7022646d67493cf990a2662bbc716bd8f662282a
- SHA512 6195e5e837d64ea41214b1bcfa803b78a4d15305ca0a034df836a95a5fe3d6e1bc6299e6f665e603e493602fb043c806ba743265bee2818f3fd62207a02ab4c5
- SSDEEP 196608:cFDlRFDlRFDlRFDltFDlRFDlRFDlRFDlzWyZ/K0ttYVAATW:KpppRpppwyZ/K0ttYZTW
- TLSH T1BAC67D17B29440F9E866D138CE719222EA317C2547F1E9CF239076A92F736D17B38726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1