General
- Target 2026-08-02_9a5069a1aee74b8b8939673b8a37da97_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 6.5MB
- Sample260802-v3xaqsdc76
- SHA256 a2f6e5e36287769c5500292652476822c5906e0de6a66d3c90fd8fbbe10db303
- MD5 9a5069a1aee74b8b8939673b8a37da97
- SHA1 8c677619e95ffc007c05171a3215be840e05ad3c
- SHA512 4d8ca497eabbb31854ced57ea4d38dc14be79b949091f141a301081fcf43df805286273607782191d3883c7cfb09e06154cb59a668fb0da597eb7cf5e22ea1b4
- SSDEEP 49152:wabH/N2abH/2abH/labH//I1x+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1P:CI1M0oAaldmdmnpgI1M0oAaldmdmnpdY
- TLSH T1A8665A13A2844899E156C078DE15C135EB227C6D4BF264FF32807BDA3A33AD27B79716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_9a5069a1aee74b8b8939673b8a37da97_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win10v2004-20260513-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_9a5069a1aee74b8b8939673b8a37da97_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win11ltsc2024-20260709-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_9a5069a1aee74b8b8939673b8a37da97_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 6.5MB
- SHA256 a2f6e5e36287769c5500292652476822c5906e0de6a66d3c90fd8fbbe10db303
- MD5 9a5069a1aee74b8b8939673b8a37da97
- SHA1 8c677619e95ffc007c05171a3215be840e05ad3c
- SHA512 4d8ca497eabbb31854ced57ea4d38dc14be79b949091f141a301081fcf43df805286273607782191d3883c7cfb09e06154cb59a668fb0da597eb7cf5e22ea1b4
- SSDEEP 49152:wabH/N2abH/2abH/labH//I1x+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1P:CI1M0oAaldmdmnpgI1M0oAaldmdmnpdY
- TLSH T1A8665A13A2844899E156C078DE15C135EB227C6D4BF264FF32807BDA3A33AD27B79716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1