2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

General

Target
2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar
Size 1.8MB
Sample260823-ajftesgg97
SHA256 237402abe9700d2e4ad0f03128a7631e6df575b5e183d01e63ff2c724d4b2725
MD5 cd9e8a8a6bfbcd3b2c99b89b9ad45b68
SHA1 22d259d68f81251fe00b52f64c012ce4e8814f67
SHA512 4309ab559f07ff0fd9f13778367f3f6582dbf425861f5c756ce8d86dbb2b97cda0a531ad25e8ed8b01994684dbc2f0b93167c781979c1d8027807dd225217724
SSDEEP 12288:EZ41TtTuRWny8d+roTfREZW9Ax3K8CbEcieT6O48OwgIk55bCu/8huoMTJ/8rov/:ftTuRWFsronbEqa6+GG8yKrO4c
TLSH
T110958E1BB79400E8D42AC175CB654236E672BC560B30AADF06D0B3692F77AF46F3A714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

File Explorer

2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

.exe 1.8MB

2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

IMPHASH 9135dd62a76519fbb901484cd96ec33f
SHA256 237402abe9700d2e4ad0f03128a7631e6df575b5e183d01e63ff2c724d4b2725
MD5 cd9e8a8a6bfbcd3b2c99b89b9ad45b68
SHA1 22d259d68f81251fe00b52f64c012ce4e8814f67
SHA512 4309ab559f07ff0fd9f13778367f3f6582dbf425861f5c756ce8d86dbb2b97cda0a531ad25e8ed8b01994684dbc2f0b93167c781979c1d8027807dd225217724
SSDEEP 12288:EZ41TtTuRWny8d+roTfREZW9Ax3K8CbEcieT6O48OwgIk55bCu/8huoMTJ/8rov/:ftTuRWFsronbEqa6+GG8yKrO4c
TLSH
T110958E1BB79400E8D42AC175CB654236E672BC560B30AADF06D0B3692F77AF46F3A714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub _CIcos _adj_fptan __vbaStrI4 __vbaVarMove __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaEnd __vbaFreeVarList __vbaPut3 _adj_fdiv_m64 __vbaPut4 __vbaNextEachVar _adj_fprem1 ord518 ord519 __vbaStrCat __vbaVarCmpNe __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaVarForInit __vbaExitProc ord593 ord594 __vbaOnError _adj_fdiv_m16i _adj_fdivr_m16i ord598 __vbaBoolVarNull __vbaVargVar _CIsin ord525 ord632 __vbaChkstk ord526 __vbaFileClose __vbaGenerateBoundsError ord529 __vbaGet3 __vbaGet4 __vbaVarTstEq __vbaObjVar DllFunctionCall __vbaVarOr __vbaVarLateMemSt ord670 _adj_fpatan ord600 _CIsqrt __vbaExceptHandler __vbaStrToUnicode _adj_fprem _adj_fdivr_m64 ord608 ord716 __vbaFPException __vbaInStrVar __vbaStrVarVal __vbaVarCat ord535 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaNew2 __vbaVarLateMemCallLdRf ord570 _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaFreeStrList ord576 _adj_fdivr_m32 _adj_fdiv_r ord578 ord100 __vbaVarSetVar __vbaI4Var __vbaVarCmpEq __vbaLateMemCall __vbaVarAdd __vbaStrToAnsi __vbaVarDup ord616 __vbaFpI4 __vbaVarLateMemCallLd __vbaVarCopy __vbaVarTstGe ord617 __vbaVarSetObjAddref _CIatan __vbaStrMove __vbaForEachVar _allmul _CItan __vbaAryUnlock __vbaFPInt __vbaVarForNext _CIexp __vbaMidStmtBstr __vbaFreeObj ord580 __vbaFreeStr

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_cd9e8a8a6bfbcd3b2c99b89b9ad45b68_cobalt-strike_elex_hijackloader_icedid_njrat_vidar

msvbvm60

generic