General
- Target 2026-07-11_94a335a0e30963a29a632e153e6fa693_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 6.1MB
- Sample260711-p39ceacx2x
- SHA256 2119c59f0ecf825dc5d9aca19169ecf67c6b06513f0985df425ffb46cd01f110
- MD5 94a335a0e30963a29a632e153e6fa693
- SHA1 d187e0ef5232997575e03237dbe161d3826c002f
- SHA512 9e43b0210324adf596b9062550c0bda691de7252224186794a52bbafeaf776b0ae783ffc54364aaca7bc5a1bc284b0e78d0de7ac8b623310a926c532febb2ff4
- SSDEEP 49152:PabH/LfI4erPrgjI45TMwwapIgTgabH/LI4erPrgjI45TMwwapIgTB/7t0i0FZam:0Itr9LapIOItr9LapIgnUm8Uj
- TLSH T1D2562A2271A204A9F549D972CF06A335A7D13C698FF192EFF50572C92B725E03B3970A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_94a335a0e30963a29a632e153e6fa693_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_94a335a0e30963a29a632e153e6fa693_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win11ltsc2024-20260710-en
12 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-11_94a335a0e30963a29a632e153e6fa693_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee_vidar
- Size 6.1MB
- SHA256 2119c59f0ecf825dc5d9aca19169ecf67c6b06513f0985df425ffb46cd01f110
- MD5 94a335a0e30963a29a632e153e6fa693
- SHA1 d187e0ef5232997575e03237dbe161d3826c002f
- SHA512 9e43b0210324adf596b9062550c0bda691de7252224186794a52bbafeaf776b0ae783ffc54364aaca7bc5a1bc284b0e78d0de7ac8b623310a926c532febb2ff4
- SSDEEP 49152:PabH/LfI4erPrgjI45TMwwapIgTgabH/LI4erPrgjI45TMwwapIgTB/7t0i0FZam:0Itr9LapIOItr9LapIgnUm8Uj
- TLSH T1D2562A2271A204A9F549D972CF06A335A7D13C698FF192EFF50572C92B725E03B3970A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1