General
- Target 2026-08-04_eaf1ce7d868abc16c681bc2a22d1d1c0_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 2.1MB
- Sample260805-ad1awaaf57
- SHA256 e1f25182880659e3acedcdf7a32d1c49414e2f633726968943c44eb5fdbc5539
- MD5 eaf1ce7d868abc16c681bc2a22d1d1c0
- SHA1 6b2993465fc339839d9f3c681d4931aa43e94e18
- SHA512 5f45afcb12a5622b8b200c77d5ad74ecaa7fe8758f81ba6e76befd370dbec45978d9e3f55ec45b6b6f81697cab7eabb6bcdcb8c58a526b33bdab3c58e6e8e69a
- SSDEEP 49152:wabH/ntugabH/LtuFI1TabH/ntugabH/LtuFI1yfu0:jAAI1IAAI1yz
- TLSH T1F1A56C13B65450BAD896C074AA569167F9253C390760BCCF63C07B263E73BD27BB870A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-04_eaf1ce7d868abc16c681bc2a22d1d1c0_elex_hijackloader_icedid_njrat_redline-stealer_rhadamant.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-08-04_eaf1ce7d868abc16c681bc2a22d1d1c0_elex_hijackloader_icedid_njrat_redline-stealer_rhadamant.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-08-04_eaf1ce7d868abc16c681bc2a22d1d1c0_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 2.1MB
- SHA256 e1f25182880659e3acedcdf7a32d1c49414e2f633726968943c44eb5fdbc5539
- MD5 eaf1ce7d868abc16c681bc2a22d1d1c0
- SHA1 6b2993465fc339839d9f3c681d4931aa43e94e18
- SHA512 5f45afcb12a5622b8b200c77d5ad74ecaa7fe8758f81ba6e76befd370dbec45978d9e3f55ec45b6b6f81697cab7eabb6bcdcb8c58a526b33bdab3c58e6e8e69a
- SSDEEP 49152:wabH/ntugabH/LtuFI1TabH/ntugabH/LtuFI1yfu0:jAAI1IAAI1yz
- TLSH T1F1A56C13B65450BAD896C074AA569167F9253C390760BCCF63C07B263E73BD27BB870A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1