General
- Target 2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar
- Size 10.0MB
- Sample260723-vc3d3ashqb
- SHA256 b16adb4b91f7d6de7ecb8b58bed87720600f8b8f65f2233198057d919c6f4d00
- MD5 853b09dab3c264536ec0e55933b9e9eb
- SHA1 f95764f5fcf182c66d0fa6b953fab6243a81a057
- SHA512 0a783175534bc4b2d094364653aa77d10b4b16355ca2eb06d8267ad7c03d2c98f2d06a29a4a9cd47a8e59a1f101e996bae11c66fe3582952d9969bad3bbbfcee
- SSDEEP 49152:wabH/xLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpi:3sr0oAaldms
- TLSH T1FCB68C17F29500EDE45AC07897969536E9327C590720B9EF13C0AB662F33BE06B3DB16
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-07-23_853b09dab3c264536ec0e55933b9e9eb_cobalt-strike_elex_hijackloader_icedid_njrat_vidar
- Size 10.0MB
- SHA256 b16adb4b91f7d6de7ecb8b58bed87720600f8b8f65f2233198057d919c6f4d00
- MD5 853b09dab3c264536ec0e55933b9e9eb
- SHA1 f95764f5fcf182c66d0fa6b953fab6243a81a057
- SHA512 0a783175534bc4b2d094364653aa77d10b4b16355ca2eb06d8267ad7c03d2c98f2d06a29a4a9cd47a8e59a1f101e996bae11c66fe3582952d9969bad3bbbfcee
- SSDEEP 49152:wabH/xLh+fuF+Cq99LyHHI+t6O8N+ailEy6dmpi:3sr0oAaldms
- TLSH T1FCB68C17F29500EDE45AC07897969536E9327C590720B9EF13C0AB662F33BE06B3DB16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1