General
- Target 2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 2.1MB
- Sample260809-hcfh3ssdpf
- SHA256 37f9a252450c276e8c06806a4d7e3de228312db4c694c593fbaa6ad56dfb802f
- MD5 a35d3eb5ab420200b9a7fff1a2a73628
- SHA1 c0b0659d6fd1e8391beee11ba693092a99a04e3a
- SHA512 82105c14db44ec8794a0247b5415423210b9cc16d648b5c16bd166b355c543b406a267be2d06b7460247addec2751f00344faabd3d704a9582253d3b30b206ee
- SSDEEP 24576:w4R5CIH/7AI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45a:wabH/8I1Ffu6Ufuqy+T28foh0Y1oQTb
- TLSH T1F4A59E12B78098A2DC6A8430B8F5D616AB31BCA11B50C6F76395F35D1F337D1AA7831B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_re.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-08-09_a35d3eb5ab420200b9a7fff1a2a73628_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 2.1MB
- SHA256 37f9a252450c276e8c06806a4d7e3de228312db4c694c593fbaa6ad56dfb802f
- MD5 a35d3eb5ab420200b9a7fff1a2a73628
- SHA1 c0b0659d6fd1e8391beee11ba693092a99a04e3a
- SHA512 82105c14db44ec8794a0247b5415423210b9cc16d648b5c16bd166b355c543b406a267be2d06b7460247addec2751f00344faabd3d704a9582253d3b30b206ee
- SSDEEP 24576:w4R5CIH/7AI1niGnB9umZnAiGnB9um9hhe+TjszNhmbLoh0BW1oE1tT45a:wabH/8I1Ffu6Ufuqy+T28foh0Y1oQTb
- TLSH T1F4A59E12B78098A2DC6A8430B8F5D616AB31BCA11B50C6F76395F35D1F337D1AA7831B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1