General
- Target 2026-08-21_dae1c38e6dc5b92f941934d30aa74b4d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar_wannacry
- Size 10.4MB
- Sample260822-bevmfszeme
- SHA256 8f88377a9ae67b663b5520ac61cf7c8963e60e5adcedf8bf0c980b45a984ea53
- MD5 dae1c38e6dc5b92f941934d30aa74b4d
- SHA1 fe519e3df17fdc2bc1a0d408c85c4f7d5708b626
- SHA512 278fd5610509f1e0dce0a679292ad2a4d1f9ac2486673c9b322d1642dff6ca012cacd1430f99377e479645d1fcb0b9989aee9b0715647a81fcfe3eb26dda8992
- SSDEEP 98304:lIyatduIyatdwmi78gkwo3dvmanIyatduIyatdwmi78gkwo3dvmadmaV:HQdWQdd3deaxQdWQdd3deakaV
- TLSH T112B62A61B1208226F062ED77C69A7719FC303D961F70858FD60DB72C2E362F29A76365
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-21_dae1c38e6dc5b92f941934d30aa74b4d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-08-21_dae1c38e6dc5b92f941934d30aa74b4d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-08-21_dae1c38e6dc5b92f941934d30aa74b4d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar_wannacry
- Size 10.4MB
- SHA256 8f88377a9ae67b663b5520ac61cf7c8963e60e5adcedf8bf0c980b45a984ea53
- MD5 dae1c38e6dc5b92f941934d30aa74b4d
- SHA1 fe519e3df17fdc2bc1a0d408c85c4f7d5708b626
- SHA512 278fd5610509f1e0dce0a679292ad2a4d1f9ac2486673c9b322d1642dff6ca012cacd1430f99377e479645d1fcb0b9989aee9b0715647a81fcfe3eb26dda8992
- SSDEEP 98304:lIyatduIyatdwmi78gkwo3dvmanIyatduIyatdwmi78gkwo3dvmadmaV:HQdWQdd3deaxQdWQdd3deakaV
- TLSH T112B62A61B1208226F062ED77C69A7719FC303D961F70858FD60DB72C2E362F29A76365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1