2026-08-08_9bbb2016e218a0e5f06b5e06ed639977_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_9bbb2016e218a0e5f06b5e06ed639977_cobalt-strike_elex_hijackloader_icedid_njrat_vidar
Size 1.6MB
Sample260808-dkcpya11es
SHA256 056eb4cee6620fcd8f52a6430b52eb851fb19066e5f3a51a6643c86f7782a802
MD5 9bbb2016e218a0e5f06b5e06ed639977
SHA1 ed361eabc0f68d74b388e47fc9880da7048268d6
SHA512 21439d4a81bdf463b55dfec038ac03d6ee031421c91b1ffcf12056e83d15f4e832703acde226b4e5743c4174b3422f74d3e136a2888724187d27620f0ed1d87d
SSDEEP 24576:8zauZZy6i1zuxw7ljsarakkqt4jtwBDIiukOiFOPfepJ12eCtsO8e7zYB:82ky6i1zuajsauZjahgA2eQJa
TLSH
T182754A1A63EC01E4E5B79639DA724556D672BC221B31D6CF1350863D2F33AD09E3AF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_9bbb2016e218a0e5f06b5e06ed639977_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

File Explorer

2026-08-08_9bbb2016e218a0e5f06b5e06ed639977_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

.exe 1.6MB

2026-08-08_9bbb2016e218a0e5f06b5e06ed639977_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

IMPHASH a0134d609f618d627a963155ef434726
SHA256 056eb4cee6620fcd8f52a6430b52eb851fb19066e5f3a51a6643c86f7782a802
MD5 9bbb2016e218a0e5f06b5e06ed639977
SHA1 ed361eabc0f68d74b388e47fc9880da7048268d6
SHA512 21439d4a81bdf463b55dfec038ac03d6ee031421c91b1ffcf12056e83d15f4e832703acde226b4e5743c4174b3422f74d3e136a2888724187d27620f0ed1d87d
SSDEEP 24576:8zauZZy6i1zuxw7ljsarakkqt4jtwBDIiukOiFOPfepJ12eCtsO8e7zYB:82ky6i1zuajsauZjahgA2eQJa
TLSH
T182754A1A63EC01E4E5B79639DA724556D672BC221B31D6CF1350863D2F33AD09E3AF22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\T\M\BuildResults\bin\Release\Plug_ins\pi_brokers\32BitMAPIBroker.pdb

kernel32

WaitForSingleObject CreateFileW DisconnectNamedPipe GetLastError SetEvent CloseHandle CreateThread ResetEvent GetProcAddress LocalFree DeleteCriticalSection GetCurrentProcessId GetModuleHandleW TransactNamedPipe GetFileType CreateEventA WaitNamedPipeW ConnectNamedPipe LocalAlloc GetCurrentThreadId VerSetConditionMask VerifyVersionInfoW CreateNamedPipeA WaitForMultipleObjects PeekNamedPipe OpenProcess GetOverlappedResult FlushFileBuffers InitializeCriticalSection LoadLibraryA FreeLibrary WideCharToMultiByte Sleep GetCommandLineA MultiByteToWideChar TlsAlloc TlsGetValue TlsSetValue TlsFree CreateSemaphoreA GetCurrentThread OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateMutexW LeaveCriticalSection CreateNamedPipeW WriteFile GetCurrentProcess EnterCriticalSection SetLastError SetNamedPipeHandleState InitializeCriticalSectionEx ReadFile

user32

GetMessageA DispatchMessageA TranslateMessage

advapi32

OpenThreadToken OpenProcessToken GetTokenInformation ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorA

shell32

SHGetFileInfoW

ole32

CoWaitForMultipleHandles

msvcp140

?_Xlength_error@std@@YAXPBD@Z

vcruntime140

_except_handler4_common memchr __current_exception_context memmove memset __CxxFrameHandler3 __current_exception memcpy __std_exception_destroy __std_exception_copy __std_terminate memcmp _CxxThrowException _purecall

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function terminate _controlfp_s _set_invalid_parameter_handler _invalid_parameter_noinfo_noreturn _errno _invalid_parameter_noinfo _crt_atexit _initialize_onexit_table

api-ms-win-crt-string-l1-1-0

strlen strtok_s wcstok_s wcscat_s wcscpy_s

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vswscanf __stdio_common_vsnwprintf_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_9bbb2016e218a0e5f06b5e06ed639977_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

kernel32

user32

advapi32

shell32

ole32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic