General
- Target 2026-07-10_e63c9167a931923fdcae600e593524a4_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar
- Size 6.4MB
- Sample260710-xxa7esft9q
- SHA256 ed5a28073caa6fc6b894671aa579d7e5f76ee931bf3a6ad67c252f8d6d736dd9
- MD5 e63c9167a931923fdcae600e593524a4
- SHA1 d72ee72ebcedb75e0850778f56834d1f28f2e932
- SHA512 ab45aa4830885c43f60fb3b898eb60c78057d55d482f6ddd7f663e9bad468407e46f1dfb9f2d941a6b55e80ba72ac233c6ec884f8da627d357c3393f83ebfc29
- SSDEEP 98304:+e5x6c1QVb6Ee5x6c1QVb62+YPppCpU2h:l8Vb6H8Vb6W2Vh
- TLSH T115669D17F69540F5D06AC430869A9232EA72BC550B31A7DF13A0F7592F33AD06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_e63c9167a931923fdcae600e593524a4_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_e63c9167a931923fdcae600e593524a4_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-10_e63c9167a931923fdcae600e593524a4_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar
- Size 6.4MB
- SHA256 ed5a28073caa6fc6b894671aa579d7e5f76ee931bf3a6ad67c252f8d6d736dd9
- MD5 e63c9167a931923fdcae600e593524a4
- SHA1 d72ee72ebcedb75e0850778f56834d1f28f2e932
- SHA512 ab45aa4830885c43f60fb3b898eb60c78057d55d482f6ddd7f663e9bad468407e46f1dfb9f2d941a6b55e80ba72ac233c6ec884f8da627d357c3393f83ebfc29
- SSDEEP 98304:+e5x6c1QVb6Ee5x6c1QVb62+YPppCpU2h:l8Vb6H8Vb6W2Vh
- TLSH T115669D17F69540F5D06AC430869A9232EA72BC550B31A7DF13A0F7592F33AD06F3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry