General
- Target 2026-08-08_4d81d3e4a96926281c821f7172571317_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar
- Size 10.4MB
- Sample260808-ryxtxsea22
- SHA256 8f169a10cbdeb50a4d7f3e36dd7de62d59051efd874bb09f08074be282f134b7
- MD5 4d81d3e4a96926281c821f7172571317
- SHA1 0137745b19cb8f2eecae3f9ae9c3c899ec0c4e92
- SHA512 36b69fd613e6ff7622583ca007f270a63b37f714ceb1ba2bb93e72c112f14f21da9017a41229692a77c0112bd83bc64985cc59e5ebaa18a67787ba273fc13ea9
- SSDEEP 98304:nu5x6M1WoDD+QvGAdlCEL8c/bRNw5CPWQtZ/K0tGOFWVRuLftCTdb:Qi8PvyEYc/b3w8PWyZ/K0ttYVAATdb
- TLSH T133B67D13B6E840F5E06AD134CA368631EB727C164BB1A6DF1150F69A2F336D07E39726
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_4d81d3e4a96926281c821f7172571317_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_4d81d3e4a96926281c821f7172571317_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_4d81d3e4a96926281c821f7172571317_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar
- Size 10.4MB
- SHA256 8f169a10cbdeb50a4d7f3e36dd7de62d59051efd874bb09f08074be282f134b7
- MD5 4d81d3e4a96926281c821f7172571317
- SHA1 0137745b19cb8f2eecae3f9ae9c3c899ec0c4e92
- SHA512 36b69fd613e6ff7622583ca007f270a63b37f714ceb1ba2bb93e72c112f14f21da9017a41229692a77c0112bd83bc64985cc59e5ebaa18a67787ba273fc13ea9
- SSDEEP 98304:nu5x6M1WoDD+QvGAdlCEL8c/bRNw5CPWQtZ/K0tGOFWVRuLftCTdb:Qi8PvyEYc/b3w8PWyZ/K0ttYVAATdb
- TLSH T133B67D13B6E840F5E06AD134CA368631EB727C164BB1A6DF1150F69A2F336D07E39726
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry