General
- Target 2026-07-18_d9905e6aa24a2fe8b860f5b021d3aa4f_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar
- Size 9.5MB
- Sample260718-gwkfpsdv51
- SHA256 87a933f878f0f3f35505c99aa64d7ceafa5ad8918a36880b345d20c8195e505e
- MD5 d9905e6aa24a2fe8b860f5b021d3aa4f
- SHA1 5395e26a49aa84cddefebc2abedcef194b894755
- SHA512 2b5e9b06cf1e951bb4533f6ea5ae1d1cb65d9602995700b17e1cb1ddbe835df2835ba9911779b06d1ef462d58005134cb6907fbfeee7d4b95586f5d033680d53
- SSDEEP 98304:nu5x6M1WoDDklJ6qCu5x6M1WoDwu5x6M1WoDDklJ6qCu5x6M1WoDqLxDy:Qi8kLriMi8kLriVly
- TLSH T167A69F02B6D440BAE17E8A30957A9632DA76BC460B11DBCF5790F65E2E337C09E35327
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-18_d9905e6aa24a2fe8b860f5b021d3aa4f_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_d9905e6aa24a2fe8b860f5b021d3aa4f_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-18_d9905e6aa24a2fe8b860f5b021d3aa4f_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar
- Size 9.5MB
- SHA256 87a933f878f0f3f35505c99aa64d7ceafa5ad8918a36880b345d20c8195e505e
- MD5 d9905e6aa24a2fe8b860f5b021d3aa4f
- SHA1 5395e26a49aa84cddefebc2abedcef194b894755
- SHA512 2b5e9b06cf1e951bb4533f6ea5ae1d1cb65d9602995700b17e1cb1ddbe835df2835ba9911779b06d1ef462d58005134cb6907fbfeee7d4b95586f5d033680d53
- SSDEEP 98304:nu5x6M1WoDDklJ6qCu5x6M1WoDwu5x6M1WoDDklJ6qCu5x6M1WoDqLxDy:Qi8kLriMi8kLriVly
- TLSH T167A69F02B6D440BAE17E8A30957A9632DA76BC460B11DBCF5790F65E2E337C09E35327
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry