General
- Target 2026-07-09_9b6c81635c981f707508716d77cc927d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar
- Size 5.8MB
- Sample260709-vdpvcsdy7r
- SHA256 23e49dffa8d6ac307efaeb8b4fb003ee47361cb8a5f16d279c001b93d0d6dd7f
- MD5 9b6c81635c981f707508716d77cc927d
- SHA1 7e23c7e8d118da3fdedb91d5dbb253012dd97eb9
- SHA512 ce2594405bb03379c6cbdfdd4c28c3316cc6482ca210eca52e814f058390bfbe230e2dd3419fc7140b92d3aa98e0b77f28316ad18e109f4fa5ea6050f39e73e0
- SSDEEP 49152:wabH/g8abH/BaRJS+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkys+Cq99q:xRV0oAaldmdmnpd0oAaldmdmnp4
- TLSH T1E9562803A19544E9D15AC074DE46C139EB227C5D87F269FB36807ADA3BB3AD03B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_9b6c81635c981f707508716d77cc927d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_9b6c81635c981f707508716d77cc927d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
Resource
win11ltsc2024-20260709-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_9b6c81635c981f707508716d77cc927d_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar
- Size 5.8MB
- SHA256 23e49dffa8d6ac307efaeb8b4fb003ee47361cb8a5f16d279c001b93d0d6dd7f
- MD5 9b6c81635c981f707508716d77cc927d
- SHA1 7e23c7e8d118da3fdedb91d5dbb253012dd97eb9
- SHA512 ce2594405bb03379c6cbdfdd4c28c3316cc6482ca210eca52e814f058390bfbe230e2dd3419fc7140b92d3aa98e0b77f28316ad18e109f4fa5ea6050f39e73e0
- SSDEEP 49152:wabH/g8abH/BaRJS+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkys+Cq99q:xRV0oAaldmdmnpd0oAaldmdmnp4
- TLSH T1E9562803A19544E9D15AC074DE46C139EB227C5D87F269FB36807ADA3BB3AD03B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1