General
- Target 2026-07-14_3cffe8afcd641001c68a02536e91945c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar
- Size 7.1MB
- Sample260714-xtbzjsby6m
- SHA256 9527891bcfd21eb5ae7cd615f611a24d05f7e9660e6d0a697bdb6f575fb2cb11
- MD5 3cffe8afcd641001c68a02536e91945c
- SHA1 6919a2fe1ce4da5b083dfb3b64fb510062e69c8e
- SHA512 c49d9dc4052d7b3a16104519e83c29497c601935d793b6ad2886f948be61797840fbf513a13c727ae02e0ed4ad21ae3adefab5f54bc720288aa25585ce193934
- SSDEEP 98304:Su5x6M1cIu5x6M1cSLapIAu5x6M1cIu5x6M1cSLapIi:Jw7wScITw7wScIi
- TLSH T11E765B6271E200B6D6999031CF49A33597E17C698BF1C7E7B206F7C52F325C07A3A61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_3cffe8afcd641001c68a02536e91945c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_3cffe8afcd641001c68a02536e91945c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260710-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-14_3cffe8afcd641001c68a02536e91945c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar
- Size 7.1MB
- SHA256 9527891bcfd21eb5ae7cd615f611a24d05f7e9660e6d0a697bdb6f575fb2cb11
- MD5 3cffe8afcd641001c68a02536e91945c
- SHA1 6919a2fe1ce4da5b083dfb3b64fb510062e69c8e
- SHA512 c49d9dc4052d7b3a16104519e83c29497c601935d793b6ad2886f948be61797840fbf513a13c727ae02e0ed4ad21ae3adefab5f54bc720288aa25585ce193934
- SSDEEP 98304:Su5x6M1cIu5x6M1cSLapIAu5x6M1cIu5x6M1cSLapIi:Jw7wScITw7wScIi
- TLSH T11E765B6271E200B6D6999031CF49A33597E17C698BF1C7E7B206F7C52F325C07A3A61A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry