General
- Target 2026-07-24_5796102ef5dc1e2296bc24c282358f23_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 6.3MB
- Sample260724-mckj9ack7z
- SHA256 76796c3787293203f49939d663ebe1134b5eb4b1da7192445ec5afcf633501a5
- MD5 5796102ef5dc1e2296bc24c282358f23
- SHA1 f28e0c3aab37e07e0fc307ba204df3922e89e365
- SHA512 af179d8c860a37512811e7795869af2ef4ee89da0da01d65a2ede2aa69f3bd60e0e7ea02a89208fe995e209360c8609d113261d677e2df9c75f9dc628d39e904
- SSDEEP 98304:aI1FDMOWQtZ/K0tGOFWVRuLftCTRnUm8Uw:tFDrWyZ/K0ttYVAATR18Uw
- TLSH T152666B13F6A940E9E06AD178CF258231EB727C5A4BF1A5DF228072D51E77AD07B38721
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-24_5796102ef5dc1e2296bc24c282358f23_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-07-24_5796102ef5dc1e2296bc24c282358f23_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-07-24_5796102ef5dc1e2296bc24c282358f23_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 6.3MB
- SHA256 76796c3787293203f49939d663ebe1134b5eb4b1da7192445ec5afcf633501a5
- MD5 5796102ef5dc1e2296bc24c282358f23
- SHA1 f28e0c3aab37e07e0fc307ba204df3922e89e365
- SHA512 af179d8c860a37512811e7795869af2ef4ee89da0da01d65a2ede2aa69f3bd60e0e7ea02a89208fe995e209360c8609d113261d677e2df9c75f9dc628d39e904
- SSDEEP 98304:aI1FDMOWQtZ/K0tGOFWVRuLftCTRnUm8Uw:tFDrWyZ/K0ttYVAATR18Uw
- TLSH T152666B13F6A940E9E06AD178CF258231EB727C5A4BF1A5DF228072D51E77AD07B38721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1