General
- Target 2026-08-18_38087ce485f7b99c729d44b03dac4c06_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar
- Size 13.3MB
- Sample260818-slyfcswthw
- SHA256 157bc806bdfb091f0861829f7c6a4719b1a172c3ad782af3d41b9d90332137d7
- MD5 38087ce485f7b99c729d44b03dac4c06
- SHA1 6fd9bf48279e7848d9918e68aeb349159f438cc1
- SHA512 115798ea0ac7378584a572fefc5a84f10763ee486645c1c48db99d31eeccf15da05d1f3dbf94a08737cb219fc958c405b22994f84fbd1a64c4ab58bb0f635bd3
- SSDEEP 196608:l8Vb618UfKvyEYc/b3w8PWyZ/K0ttYVAAToGn:2cOvyEYKbayZ/K0ttYZToG
- TLSH T1B5E67D13B6E840F4E0AAD174CA768632E7727C154B71A6DF1250F69E2F33AD06E39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-18_38087ce485f7b99c729d44b03dac4c06_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_38087ce485f7b99c729d44b03dac4c06_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-18_38087ce485f7b99c729d44b03dac4c06_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar
- Size 13.3MB
- SHA256 157bc806bdfb091f0861829f7c6a4719b1a172c3ad782af3d41b9d90332137d7
- MD5 38087ce485f7b99c729d44b03dac4c06
- SHA1 6fd9bf48279e7848d9918e68aeb349159f438cc1
- SHA512 115798ea0ac7378584a572fefc5a84f10763ee486645c1c48db99d31eeccf15da05d1f3dbf94a08737cb219fc958c405b22994f84fbd1a64c4ab58bb0f635bd3
- SSDEEP 196608:l8Vb618UfKvyEYc/b3w8PWyZ/K0ttYVAAToGn:2cOvyEYKbayZ/K0ttYZToG
- TLSH T1B5E67D13B6E840F4E0AAD174CA768632E7727C154B71A6DF1250F69E2F33AD06E39721
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Drops file in Drivers directory
-
Adds Run key to start application
-
Sets desktop wallpaper using registry