2026-07-31_dcf90bc0cffb073dac09e57cdc403be3_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar

General

Target
2026-07-31_dcf90bc0cffb073dac09e57cdc403be3_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar
Size 550KB
Sample260731-24849aab76
SHA256 c818acd36d8db064928d3cf7827c6ff2826ba18373ab3d3640ee331f2e2a29b9
MD5 dcf90bc0cffb073dac09e57cdc403be3
SHA1 191e23116ef15237eeaec60c977713110de17921
SHA512 feaee8111de02d0c8f78b69aa048d154c7a9afc92d789f39c54af8da6398be687969c5b006e8c55c0a686eb5c50bf3a9fd8a0d1c496dff82e05ea10b68e3a867
SSDEEP 6144:cV2gQJQGRR15LIL9N4QL/aTB5sBZ9rPreOUc+D/0vxBzkiLz9u5:ccgHg1JZlT/sBLrHcyPz5L85
TLSH
T1E4C4AE2333A410E6E0B742B498E70716D7B6B9260721C7CF56D806BA1F337D16E7636A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables packed with ASPack 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_ASPack

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_dcf90bc0cffb073dac09e57cdc403be3_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar

2026-07-31_dcf90bc0cffb073dac09e57cdc403be3_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar

.exe 550KB

IMPHASH b941ddedcc51e5706d41335adb4e6b2a
SHA256 c818acd36d8db064928d3cf7827c6ff2826ba18373ab3d3640ee331f2e2a29b9
MD5 dcf90bc0cffb073dac09e57cdc403be3
SHA1 191e23116ef15237eeaec60c977713110de17921
SHA512 feaee8111de02d0c8f78b69aa048d154c7a9afc92d789f39c54af8da6398be687969c5b006e8c55c0a686eb5c50bf3a9fd8a0d1c496dff82e05ea10b68e3a867
SSDEEP 6144:cV2gQJQGRR15LIL9N4QL/aTB5sBZ9rPreOUc+D/0vxBzkiLz9u5:ccgHg1JZlT/sBLrHcyPz5L85
TLSH
T1E4C4AE2333A410E6E0B742B498E70716D7B6B9260721C7CF56D806BA1F337D16E7636A
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

5336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths