General
- Target 2026-08-14_32a330bf2a14543d163ffe5157228819_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar
- Size 15.0MB
- Sample260815-adedeavbkh
- SHA256 a1969929b9dcc3832dc6bad62e8f0a1f073aacc8aeb21d7952bf6056235ed429
- MD5 32a330bf2a14543d163ffe5157228819
- SHA1 5479e03367396b1d78d39d9a9d25828f5bca5f2d
- SHA512 2655ed0620fde8b4a1d1b1a6eabb8c6c3dd323f99ff3b39c822b0c33a733d1519efb3fec250281fae4db3884f437aab567c665d39856ae039723936bf227deda
- SSDEEP 98304:nu5x6M1WoDDklJ6qCu5x6M1WoDDklJ6qQnUm8Ugu5x6M1WoDDklJ6qCu5x6M1Wop:Qi8kLri8kLO18Uzi8kLri8kLO18UJj
- TLSH T175F68E02F6D441B9E16E8634D7669632EA73BC520B61D6CF56D0F62E2E337C09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_32a330bf2a14543d163ffe5157228819_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_32a330bf2a14543d163ffe5157228819_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-14_32a330bf2a14543d163ffe5157228819_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar
- Size 15.0MB
- SHA256 a1969929b9dcc3832dc6bad62e8f0a1f073aacc8aeb21d7952bf6056235ed429
- MD5 32a330bf2a14543d163ffe5157228819
- SHA1 5479e03367396b1d78d39d9a9d25828f5bca5f2d
- SHA512 2655ed0620fde8b4a1d1b1a6eabb8c6c3dd323f99ff3b39c822b0c33a733d1519efb3fec250281fae4db3884f437aab567c665d39856ae039723936bf227deda
- SSDEEP 98304:nu5x6M1WoDDklJ6qCu5x6M1WoDDklJ6qQnUm8Ugu5x6M1WoDDklJ6qCu5x6M1Wop:Qi8kLri8kLO18Uzi8kLri8kLO18UJj
- TLSH T175F68E02F6D441B9E16E8634D7669632EA73BC520B61D6CF56D0F62E2E337C09A35323
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry