General
- Target 2026-07-09_1e2904ac82d0d7d8e7dd3e644d3304cf_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar
- Size 12.2MB
- Sample260709-wk6bcsfy7w
- SHA256 56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242
- MD5 1e2904ac82d0d7d8e7dd3e644d3304cf
- SHA1 624e01fa94d131645db27b09c5bd09bbe23087ae
- SHA512 8e170a188e51ea4e3dc31479d3f93ff4db33e25ff08ad238d01e74041c2bd1ba3ca76844098db20b8ffceb1970399398bfb116aa26e16ca642d1ad09e99f8846
- SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAAT:mqnq7yZ/K0ttYZT
- TLSH T1A4D67C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_1e2904ac82d0d7d8e7dd3e644d3304cf_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_1e2904ac82d0d7d8e7dd3e644d3304cf_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260706-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_1e2904ac82d0d7d8e7dd3e644d3304cf_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar
- Size 12.2MB
- SHA256 56a8c1d15f9cedbf64244528b4a6ce3a30b5b398299d4228b9ce052f66397242
- MD5 1e2904ac82d0d7d8e7dd3e644d3304cf
- SHA1 624e01fa94d131645db27b09c5bd09bbe23087ae
- SHA512 8e170a188e51ea4e3dc31479d3f93ff4db33e25ff08ad238d01e74041c2bd1ba3ca76844098db20b8ffceb1970399398bfb116aa26e16ca642d1ad09e99f8846
- SSDEEP 196608:Jw/h1+vKmd0hw/h1+vKmd0rWyZ/K0ttYVAAT:mqnq7yZ/K0ttYZT
- TLSH T1A4D67C13F1A440E9E1AAD174CE569231EB327C494BF1A5EF3280B6D52E37AD07B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Drops file in Drivers directory
Adds Run key to start application
Sets desktop wallpaper using registry