General
- Target 2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk
- Size 3.5MB
- Sample260706-2mr5eah15p
- SHA256 35fdf1618868600a488f08b5b60c2cb4f0cc9220b00a59b91c53f179a3e40b6a
- MD5 0ec9b8f144ac5766afa1e854c4a6714c
- SHA1 a56ed4b58b625b0cdd7d911c084f7a74684f205a
- SHA512 55d1b3de6caa8ff39643d6e217f79ba37c668702b708cd3d776a28dd6c41a0104ca4e026a0903fd0a67e80875e884534c551fb5cd84acf42bc7053b2dc5531a4
- SSDEEP 49152:hUcRqkaITh5CTi8JJzJp5vddF4VloboZUcJhd7FZZYhAM8kDZgSJYGXguEA8bdm+:Xct9JJzz/kPn678cHFTE
- TLSH T15206F11591D411F9C467C278CA8B1A0BF7A2B409732AAEDF02C549422F63FE25F7E359
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk.exe
Resource
win11ltsc2024-20260706-en
Malware Config
Targets
-
- Target 2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk
- Size 3.5MB
- SHA256 35fdf1618868600a488f08b5b60c2cb4f0cc9220b00a59b91c53f179a3e40b6a
- MD5 0ec9b8f144ac5766afa1e854c4a6714c
- SHA1 a56ed4b58b625b0cdd7d911c084f7a74684f205a
- SHA512 55d1b3de6caa8ff39643d6e217f79ba37c668702b708cd3d776a28dd6c41a0104ca4e026a0903fd0a67e80875e884534c551fb5cd84acf42bc7053b2dc5531a4
- SSDEEP 49152:hUcRqkaITh5CTi8JJzJp5vddF4VloboZUcJhd7FZZYhAM8kDZgSJYGXguEA8bdm+:Xct9JJzz/kPn678cHFTE
- TLSH T15206F11591D411F9C467C278CA8B1A0BF7A2B409732AAEDF02C549422F63FE25F7E359
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Stops running service(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1