General
- Target 2026-08-09_423651ef61bddff16451ce45831f6f9b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar
- Size 17.9MB
- Sample260809-rv6yessybs
- SHA256 d59a7333656347dabdf57accb8b980a209605a73dfc721126e894112e809dbaa
- MD5 423651ef61bddff16451ce45831f6f9b
- SHA1 5a6312d003a7fdbce741790c01504ba504e8bb7f
- SHA512 4ada5bca5a6b96d0b827019ba157e0fcc790597eec53c39cc8c2437221e528325c2fcec29945d6c80c38c59cff25b084e9d6b5e46688b909278e0c8c77261af5
- SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0hSWyZ/K0ttYVAAT1Kmd0TGn:zyZ/K0ttYZTEqiyZ/K0ttYZTEq8G
- TLSH T141176C03F2A840E9D1AAD174CE668631EB327C594BF1A5EF325076D52E33AD07B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_423651ef61bddff16451ce45831f6f9b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_423651ef61bddff16451ce45831f6f9b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_423651ef61bddff16451ce45831f6f9b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar
- Size 17.9MB
- SHA256 d59a7333656347dabdf57accb8b980a209605a73dfc721126e894112e809dbaa
- MD5 423651ef61bddff16451ce45831f6f9b
- SHA1 5a6312d003a7fdbce741790c01504ba504e8bb7f
- SHA512 4ada5bca5a6b96d0b827019ba157e0fcc790597eec53c39cc8c2437221e528325c2fcec29945d6c80c38c59cff25b084e9d6b5e46688b909278e0c8c77261af5
- SSDEEP 196608:JSWyZ/K0ttYVAAT1Kmd0hSWyZ/K0ttYVAAT1Kmd0TGn:zyZ/K0ttYZTEqiyZ/K0ttYZTEq8G
- TLSH T141176C03F2A840E9D1AAD174CE668631EB327C594BF1A5EF325076D52E33AD07B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry