shodi | 2026-08-04_389f5354913fc1f2deab1de04286df42_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_vidar

General

Target
2026-08-04_389f5354913fc1f2deab1de04286df42_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_vidar
Size 1.2MB
Sample260804-241g4ssflf
SHA256 d1ec74441a73c22a49cd73947a08ea795eac679ec784ebe8b6632cfe02948f82
MD5 389f5354913fc1f2deab1de04286df42
SHA1 ebe61fb4d0f592e7ba21e7ef08f1fac4035dd61a
SHA512 521fd279da4d62a6142fe9ee9e8d54c1081be9f558ef705023fc6ecfc09ca16773705f4cb9a1845d9f00435bbb1becae2f969f875de0b36c4996ea12d8da6b41
SSDEEP 12288:asKkhgjI45iKl98Pbw7nw/mMuhylcsd4a4p4++F+zzNXvDFT7cOO2kDpvoc:aqgjI45bl9Mbonwap41+zzPTThwvB
TLSH
T1F7457C17A19108EAD3EAD070CE46D536EB22746E07F665FB3690D2D53E27AD03B3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm shodi

Detects Shodi worm 1 IoCs

resource	yara_rule
sample	family_shodi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_389f5354913fc1f2deab1de04286df42_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_vidar

2026-08-04_389f5354913fc1f2deab1de04286df42_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_vidar

.exe 1.2MB

IMPHASH 77f13bc24efea5a05601b43cf44d1f1a
SHA256 d1ec74441a73c22a49cd73947a08ea795eac679ec784ebe8b6632cfe02948f82
MD5 389f5354913fc1f2deab1de04286df42
SHA1 ebe61fb4d0f592e7ba21e7ef08f1fac4035dd61a
SHA512 521fd279da4d62a6142fe9ee9e8d54c1081be9f558ef705023fc6ecfc09ca16773705f4cb9a1845d9f00435bbb1becae2f969f875de0b36c4996ea12d8da6b41
SSDEEP 12288:asKkhgjI45iKl98Pbw7nw/mMuhylcsd4a4p4++F+zzNXvDFT7cOO2kDpvoc:aqgjI45bl9Mbonwap41+zzPTThwvB
TLSH
T1F7457C17A19108EAD3EAD070CE46D536EB22746E07F665FB3690D2D53E27AD03B3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

15703

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths