daac9d7f324f2337a2809480089993a68815e00be81275ae970ac241fd25e326

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_3e36ee994909b1c154f4392d7c1ff717_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Size 5.7MB
Sample260804-tj19xadd28
SHA256 daac9d7f324f2337a2809480089993a68815e00be81275ae970ac241fd25e326
MD5 3e36ee994909b1c154f4392d7c1ff717
SHA1 9a8f0e9ed11afb914486573e47c7d0b9f8461776
SHA512 e40fad7f0c8888d01386b56b9e7367b866b12395fd61290260c62cce3a91cf31417cb76d3bd809b8142d0d0e77533d59a06bd8884e5fc126a81fe34f96af9afa
SSDEEP 49152:CqPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPn:CMKUgTH2M2m9UMpu1QfLczqssnKSk
TLSH
T14E56B41165DA9FDCC05FA474CE0669A16A237C868F61AFDF0980BE253E756B06F3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5476	svghost.exe

Executes dropped EXE 2 IoCs

pid	Process
5476	svghost.exe
6420	2026-08-04_3e36ee994909b1c154f4392d7c1ff717_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe

Loads dropped DLL 34 IoCs

pid	Process
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe
5476	svghost.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	svghost.exe
File opened (read-only)	\??\Q:	svghost.exe
File opened (read-only)	\??\K:	svghost.exe
File opened (read-only)	\??\P:	svghost.exe
File opened (read-only)	\??\R:	svghost.exe
File opened (read-only)	\??\A:	svghost.exe
File opened (read-only)	\??\B:	svghost.exe
File opened (read-only)	\??\D:	svghost.exe
File opened (read-only)	\??\J:	svghost.exe
File opened (read-only)	\??\T:	svghost.exe
File opened (read-only)	\??\U:	svghost.exe
File opened (read-only)	\??\Z:	svghost.exe
File opened (read-only)	\??\G:	svghost.exe
File opened (read-only)	\??\H:	svghost.exe
File opened (read-only)	\??\I:	svghost.exe
File opened (read-only)	\??\M:	svghost.exe
File opened (read-only)	\??\N:	svghost.exe
File opened (read-only)	\??\O:	svghost.exe
File opened (read-only)	\??\V:	svghost.exe
File opened (read-only)	\??\W:	svghost.exe
File opened (read-only)	\??\L:	svghost.exe
File opened (read-only)	\??\S:	svghost.exe
File opened (read-only)	\??\X:	svghost.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svghost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svghost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svghost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svghost.exe	2026-08-04_3e36ee994909b1c154f4392d7c1ff717_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Windows\svghost.exe	2026-08-04_3e36ee994909b1c154f4392d7c1ff717_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svghost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_3e36ee994909b1c154f4392d7c1ff717_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 5476	4104	2026-08-04_3e36ee994909b1c154f4392d7c1ff717_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_3e36ee994909b1c154f4392d7c1ff717_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_3e36ee994909b1c154f4392d7c1ff717_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\svghost.exe
  "C:\Windows\svghost.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-04_3e36ee994909b1c154f4392d7c1ff717_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5476
- - C:\Users\Admin\AppData\Local\Temp\2026-08-04_3e36ee994909b1c154f4392d7c1ff717_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-04_3e36ee994909b1c154f4392d7c1ff717_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
    3⤵
    - Executes dropped EXE
    PID:6420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.0MB
SHA256 eb30c390bc16ef9584cef4e6df4e64a55f10b3654001fea8c18a67078b2004b1
MD5 242825af25b282698a00df7341020f64
SHA1 c317d0b2470da0138bc5002cfd1fdbc564631453
SHA512 f23b05624757fdd1058f5c042dba871268c455039281e09ac3b8f882298d1c836d88eb983257310bf44bede80ca6f2b5d71ec0bebe364daf66ec035bce9c2312
SSDEEP 12288:AkVyY5i8vaa81soeyezSC6v/ciLKK3kg5aqghpSy1TIPxTmqCLwKzu/:RkQPa7/ezSC6vUyD/aqgrvWx6q8wyu
TLSH
T1CA35F915F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 692KB
SHA256 0163ec83208b4902a2846de998a915de1b9e72aba33d98d5c8a14a8fbf0f6101
MD5 4159ff3f09b72e504e25a5f3c7ed3a5b
SHA1 b79ab2c83803e1d6da1dcd902f41e45d6cd26346
SHA512 48f54f0ab96be620db392b4c459a49a0fa8fbe95b1c1b7df932de565cf5f77adfaae98ef1e5998f326172b5ae4ffa9896aeac0f7b98568fcde6f7b1480df4e2d
SSDEEP 12288:9VJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:9VbqPb88hv/l+7
TLSH
T152E42A66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 95KB
SHA256 60bfee02e0dae8f1f439807667afc84cc30302ed23f0818522eb2a5e14a530bc
MD5 aec445a558b4fd946196e4133692baf4
SHA1 6032c3237faa9b352f16af786dc47a1a0e9cb2fd
SHA512 78bcbefd2eb96a0d15a80d3b659c151765002433e5626e89628d7e6a6917d24c294f696af9d290561228b5ba337fd1e68cc46586fad587927160ea73a056c67e
SSDEEP 768:zt/EvFsYd9IAOGxaQg4RoRZWQ3655Kv1KjqY1MNH:zt/EyYd9IAZw4RoRZHqaN6qH
TLSH
T184A38D13DB5010D5F7FB0A31B9EA2B825FBABD218994DE1E87207B9C1C34244E965773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 95KB
SHA256 39aaa86712b5ce2f0418d89579272d0535fa6b414a0f5fce979253001ff7a8e6
MD5 ec964ba678d5a80ed56dc5842afaffad
SHA1 c0ae53ebaa609b362f638b122fddbdc541a4b7ca
SHA512 cf2cadf1bfcfffb195e43133e32f374124a70a5e952cfad7a5e7042cd35c64250319b9952e59c8d99abeb915d2b18e014ea89e7e64b7de4df76c5524aebfca08
SSDEEP 1536:YA1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IAW:DCiyiukvvVHC6++uq3eqW14k/EyK9fSt
TLSH
T1BEA301178B516056F7F70130BABF2A96917E1D62DDA8DB0E4B907ACD0E78314E862733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 362KB
SHA256 c536e97c4b08a3a96d064fe57806fb1e6a0a6525ae905446c3d3968ab2e2b310
MD5 c093587f06d83adc9d0de3125a7e5605
SHA1 efa045a942c3093349f2c04be910796fff3a1ea9
SHA512 06c6e1851a91ddbab692af7a8431973010654b2d2b9ceaf5c1f437d73ef286eeae43431a70508e5a2612670668ec75d643dd916e4e1ea7b69cc401f4227ef0cf
SSDEEP 6144:AknVuOGK9fx/OOr/BJ/GKWWBNU6ITLBi0qttclOKgU91Bg:AkVyY5aeBNUbTVO86Uq
TLSH
T161842A3BEE28FCD2C27A8DB857918640E77274704F61A3CBD165C20E9E236E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 130KB
SHA256 5d6b0fefd20999430da9409e99bfce3168aa3f78078ea2977f2573758f93d01d
MD5 d86d4d97300c56942ce07468a79b0599
SHA1 18a94032baf0031e40afad0dcfa60898b4da91ca
SHA512 33bc075e5f91df5e2e4cf36292bb8a7ee0b8a5beb180dd02d029cd33c83cfee3b15b66160db77eb11e0666e88fc98749918d2208857a72ec5a4edee20a41fcc0
SSDEEP 3072:zCiyiukvvVHC6++uq3eqW14k/EyK9fq4nzrecrS2aozwL9:sknVuOGK9fqpcr0X9
TLSH
T1D6D3E142A7E44207F9FB0F30B6F586521A7CABD37D30C61F1985B49A1D637808A21B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.2MB
SHA256 6974945ec6b703b9ed69d7e0749cfcfa31d6a4d9f25762035f0f0c18472c93d0
MD5 6345f046a870fa431bd309b71f44dea1
SHA1 d658efe02de2745e1df687c10b081cbfcf7947eb
SHA512 137fddfef4de0b4d9fdf22aab48b8b3647e72610ea84be93d860d4609caa498d437ffe1be3f2ddc6b19d086b2a929a5fdc8cfca23aa0c8747470f767be372dce
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DNoDN5J8NRVT:ZQvGAdlCEL8c/bRNoNw5CO
TLSH
T178165B656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.2MB
SHA256 c48b72a2aab652155216686000d4c81b3a6ab8d8537abb36e9174b973bc10060
MD5 7f5a3b937d3045722a02d8287893e2de
SHA1 84d720da42ab04d7f37c86d82894bdcbd8e859aa
SHA512 06b58f4b3633e2117ef582d80aeb8ef967bcfb5839b7abdfb3a575086953ce3b2aa555786bc2677278c70794622617d847d3864eb60044734480cadaf1ef494d
SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5p5J8NRV3j:ZQvGAdlCEL8c/bRNbw5CO
TLSH
T15A165C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 440KB
SHA256 76963b7bd4c28e3218bb472299157c77e5968e0e5f9e8e99eb92df967d6f8b8e
MD5 5c5dea08333fa84e4b1aecb0ffe620e9
SHA1 b03ed6250f04378d06271949a6c5b322270fb881
SHA512 9d0ef551b0b78b8b2491d5ecade71f40175be03e768fda2361d3d6bda4dc14a1d558b068f61c2afd23dc0d454037a6f8d5595b60b49a914cdd8daaaad7fb4a0c
SSDEEP 12288:EkVyYMhAwSfxL/2Dc3jDLLmt0LDQewsAjRE:1klCaewsAju
TLSH
T1B4A48D31FE74E036C7BB0DB21B35C716183D7A604F611AC3E3A88A9D59602D26776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.5MB
SHA256 d1352d36f08e1d90cfc220ba9213e0539900a9a8a6abd7d5fb745018d39d0aa5
MD5 7638dd0a11cd779490b157ab73d2a90d
SHA1 a4f5a1c722e35d6594ef01b206d7f99514b5b773
SHA512 cdbc9d83ee5d9360f7a0c5a1f2e8055d641259123443657a055731c332b405263ec501d21f183881a222a8d35bb7af1d81ff005bfddab5ffde1c66c190d940c4
SSDEEP 196608:XBEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHi:XBEtQevvqc2W1cpV2XI32i
TLSH
T136474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 23.5MB
SHA256 50a42bbcc08444d3548463740b5d336f0c94542c4951aefd896c7e6350ca7c3a
MD5 1474e56c94d79d98ef4974c48575bfd6
SHA1 1f393a05dc9009a3d6aab8f86896c583bff656ea
SHA512 b01b3a0577ec742341ae03c8925d3550b6f7bff0f1f227323cae780bd2e4b67fcaa00a786a49a20825096c4bfb17cff239d9d3afa9657abde269c2172e043727
SSDEEP 196608:XsEtQeTbvf2zlO12sJTv6Ja1cpVLyXIldPlbuJHi:XsEtQevvqc2W1cpV2XI32i
TLSH
T121474A91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.2MB
SHA256 694be9bbf46f337e2e537ce822337b9b4d8d8976b74bd6b93a7466da735d25cd
MD5 ac8b8ba7aed9af594097e5a076a8ab77
SHA1 d69cedfd287938ff696d1b17017d7e1be7d145bb
SHA512 c1e243edd02f75022fa89af80307860db7e72b61fc871e30c68d9bb9bbe0ea30b2396c197217b52f723b72bda0a9c44801825fac1b7af2973d708aecbfb6fdfa
SSDEEP 24576:RkQSCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344:CZCbRquA/m2yL5zbfFiV+XenmE3/z
TLSH
T1F2B55C0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.2MB
SHA256 085fc9a5731fac938a26e7dcf6e266d9c8186648438a7751b81718c384ec7aef
MD5 e8754a07f3d5d77f60d046d011a3ecd9
SHA1 2cf7935b4d3de04124c5dc4493dc57d184f50591
SHA512 9e288ee36c2baef00bb60d0632e67e37c19d5b2a836e703d13d72e90a9df13a0b4793197ed6e6d7226e0001b8ac05850ad9a3b72f34c5c47ac0e7b60978d341d
SSDEEP 24576:TQSCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344:TZCbRquA/m2yL5zbfFiV+XenmE3/z
TLSH
T1A4B55B0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 660KB
SHA256 6220f5fe454d227ff88e8ed11a5eb6b6d71ccff7678ae9483bc197aa19858c23
MD5 107d89b3f92f9d7a9a720066d41af96d
SHA1 9187fb8bf196bd31eb699c0e731fc3d73d603a6b
SHA512 d0614882a67bdd11b344f7f1ed4304cad7a6108add72a66f59a4cd4f8c7a740b5d0a553cccb6c0fe0a2b7c5dc4ed688ee378160d0aacb5d6827987d7e3140c72
SSDEEP 12288:AkVyY5FAZ/GLAIFoiwtA5qy97S9uaYFLq3Oq:RkQFAhGLAIFoiwtA5l7S53f
TLSH
T1B1E42881EBF955D4F5B3AA7899B69171EA76BCA65E30C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 338KB
SHA256 8ec28c83416dfdc5cf1a6a7cc2d12f337b2691d9d29b2ea698f094ab4e85c358
MD5 83f6a431aadf84065f4a5c90f9cafafd
SHA1 e8dc13093b948e2a3e7f250dac5b693fba8f9e09
SHA512 1c996e9de59a675176734081c784ef34bd4ce993be805aec0421005d813369d0d21908e320944f65e6cdcde21a1b24b25d81421032cc16699922250238822cbe
SSDEEP 6144:AknVuOGK9fxXmw5HEiIsCCINUGBZjgXwYz4WDZSFxgHiGfE:AkVyY5Xmw5HEjsChNVBFgl0WDm+Cp
TLSH
T180749E4677A41CF9E9A791388697C536F7B2B8122A24D71F0760C65B1F33361BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 177KB
SHA256 5b1cbf847177dd0b36faeacec2f18dcc020bf091e2360b313f30edb7dab9ce53
MD5 fcea278be4b140dd9e80700818a28819
SHA1 743526810a442613eeb688408af7c8edb468765a
SHA512 fbd83cc8ba00b914205765c7d0f3d970c4a57371566780012a249f2a678962634da768a28f83e4a3c32cdfeea60b6d11401dfc006bc2142d8fb22ae6f613ba34
SSDEEP 3072:nCiyiukvvVHC6++uq3eqW14k/EyK9fx49Dkv57OsX2T3TH0XzZP1Pwe8UXDCsCys:AknVuOGK9fxl57L2DTH0Z1Ie8YDfvat
TLSH
T1A604CF9A33E430F9E2A3523CD9F55A46E7727462673583CF026442AA1F23BD15E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 224KB
SHA256 e8823553c18d32714a242d65311f8157ff495be6bec15eb94dbf9be58d84563f
MD5 3fcb7db7629c92cf49f08bc55ad5b980
SHA1 3045a4fbc8eeb12cb0111eff6bc62c79280f9bf9
SHA512 f078382c12ec30531ce292c16758016a7716c387bbf094833eb19e69f8abd0329376c63fe3e934f5ec1586fc46fed6e687080d2c6c19da536e2c4f1052928870
SSDEEP 3072:8vJ9psmeIBcV8pu/EyK9fx49BvJ9psmeIBcV8pQFq4XKF3QP6:83psmeI+s4K9fxA3psmeI+sQFqT3Qi
TLSH
T1A424C10AD2A801E8C06EA279C7965A41F3777C6583E192CB13D0F53E1F766D09EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 224KB
SHA256 842d31ba10495a3c09e24179a6c3d44287c38b55fde48242b9d0684f092eb99f
MD5 9086777843c921084003a26ced37436a
SHA1 1fa623712cffe4e11295f1a1e51e0f68848c6727
SHA512 87815d98ccc1d9913bea6eb93bb073f093ccbf38029212b2c285d1c7283fc075d793342ff6006c24e499dddd871fd06a3f8fdfcb188676fb2f4ebcb4f4921dcf
SSDEEP 3072:nCiyiukvvVHC6++uq3eqW14k/EyK9fx49BvJ9psmeIBcV8pQFq4XKF3QP6:AknVuOGK9fxA3psmeI+sQFqT3Qi
TLSH
T1A824591AD29802E8C06E6175C7568A41B3373C6687E1D3CB13D0F57E1F76690AEEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 137KB
SHA256 f1d5b9d731c4e6cd51801217763ab1986574b2deb60ae683f2e34ee84bb0ef4e
MD5 5bb74dd8e7b51b5683049fcba07df3ca
SHA1 aec770c47aaf4552ad043b7e36dc1d1f14947390
SHA512 7197f0eaed36966496aef4a0b033c69bf4e164acb7339ef60386a9f338f4fc2e56af3a36e3f60a700b67c3daf135d429054c57b33d91f0020b0025a1529840b9
SSDEEP 3072:nCiyiukvvVHC6++uq3eqW14k/EyK9fx49d4WJgkt:AknVuOGK9fxEJJ
TLSH
T158D3E10B27F500DAE56781B0C5E25B56F93DF552A72092CF0FA9C21A1F637C49E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 145KB
SHA256 f6e4e7f2a089e6881fa91b04930f4ed0285f6b636eb77b6666b771b2ea1b6199
MD5 60ab11cecb89e898247d0a7facec10a2
SHA1 70ec981d00efbe87959cd87883a6464063067021
SHA512 208df4d9eaf48c59f04728e126e03ce871078c17960f0a8db662892de39b82ca432a586885b999cd952088391c1773a6e44d254a7db61393becada18b2be7b3e
SSDEEP 3072:nCiyiukvvVHC6++uq3eqW14k/EyK9fx49HkIvQnkraVTxoQG:AknVuOGK9fxGk3nkraVT8
TLSH
T11EE3E14513E600EED66B4274D2A35A15F47AF4228BA0E6DF0BE5C21A1F53BC0DE3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 141KB
SHA256 93b98fc9327bb6f8b0c84f2a01629b404aa9554950d56378a932b966ddb453ab
MD5 f8f7b30ec2158630f76e29cc31c5a851
SHA1 ae0fbbe8bdb2c1d15b775ac05bf5ca08fcb8f387
SHA512 d7c155b893026a409b52f511890e8bf52b4a10f043415aa95470315d0963bcaae2ddf95fae933c68b3c8ce8f992c564612723a6235e1b936dbea601d2908a9a0
SSDEEP 3072:nCiyiukvvVHC6++uq3eqW14k/EyK9fx49Vpw5Z/KtbmmD22RQXSfj:AknVuOGK9fx8pw5ySuJQX0
TLSH
T167E3E18623E200DEE16701B482B71657F979F4529BA0D6CF0BA5824D1F637D1DE3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-04_3e36ee994909b1c154f4392d7c1ff717_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-04_3e36ee994909b1c154f4392d7c1ff717_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Size 5.7MB
SHA256 f5ee36de8edf9be2ac2752b219cfdcb7ca1677071b8e116cb876306e9f1b6628
MD5 ba18e99b3e17adb5b029eaebc457dd89
SHA1 ec0458f3c00d35b323f08d4e1cc2e72899429c38
SHA512 1f41929e6f5b555b60c411c7810cbf14e3af26100df5ac4533ec3739a278c1b925687284660efb4868e3741305098e2737836229efc9fe46c97a6057c10e677c
SSDEEP 49152:BPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBJ:NKUgTH2M2m9UMpu1QfLczqssnKSk
TLSH
T1D356B31165DA9FDCC05FA474CE0669A16A237C868F61AFDF0980BE253E756B06F3810F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aieig

Path C:\Users\Admin\AppData\Local\Temp\aieig
Size 4KB
SHA256 9246c24b939c3aff800b14303e845d3f5b4757b07894e3b039fb2d5b1021e3c7
MD5 4f8b0cc1b83412f2299292f56e32910d
SHA1 f1315c9b1e2bc609d2d5f8349c7f73b6946a444b
SHA512 9578a0d16ade65b4425af88bd552266101fc9ab0bbf75281de2d6678f8cbb731cb8cf692bacd6f52727a7b975d43bce7de06e5268fe2465946f0c4830b10d3db
SSDEEP 96:2nnQTcTvcxPIBfxSQcy3Nk+0cl9/l8KnM:m0eMd
TLSH
T16D918E63630C2D36FC28A8F5ACA26362415CBF5107E4AC429A3DF42CA43EEC259F4438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jijvv

Path C:\Users\Admin\AppData\Local\Temp\jijvv
Size 630KB
SHA256 6b38f83e49397e92f36592eaa9ab966f10a63a240f32aa3d913f4de4401e0a1e
MD5 5c80f3a207d353e4da3f8deaf6896b10
SHA1 e17efe5d6085267a6873d874bd26714b6ab8c722
SHA512 c2198c4754ff77f2d261d414d9ff6fc3bd5357c589e78220b4c534bf586dbed32848c56f2e852d0ce8913208029737c07a4a7420ad1f18122f55f6b199c7d560
SSDEEP 12288:AkVyY5rXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:RkQt0Le5ji0hmxNrM
TLSH
T18DD41A16F6748335D073C0B9C5D2A69EE97130825B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svghost.exe

Path C:\Windows\svghost.exe
Size 81KB
SHA256 d71f7a98f19740884ebd74a8115b1fbed2ec17b98387fcb5dbc6966b6e481a43
MD5 e9ed450b86480aabbeaf8191f0a8aeac
SHA1 f71eb873591d58585149b8a622110d19755174cb
SHA512 53c89d5ea185f3eb841c184e55f9788f1f0c9cabfc605e9eaad3cb153433bfc0e3877a79e937f86b0772e7c2398eb093d06899f34df6cfaa4591949ca8fc36fd
SSDEEP 1536:8A1V5CfA/L3WiukvSQc+HNAn6wPHX589HiF4V1dQh3geDmN6HSKm7Ct/EyYd9IA5:nCiyiukvvVHC6++uq3eqW14k/EyK9fxL
TLSH
T1C383026B27937009D6B25134776E2BB9D03D05B1DE7C97490A82919E1B9E329AC32B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4104-2-0x0000000000427000-0x000000000043A000-memory.dmp

Download

memory/4104-1-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4104-0-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/4104-9-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5476-11-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5476-46-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/5476-45-0x0000000000400000-0x000000000043C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads