General
- Target 2026-08-30_e8b5e876d86ccdf0b8f3686ab763001f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar_wannacry
- Size 8.4MB
- Sample260831-b8v53stbna
- SHA256 7ca0ee5a3ffd3a5111f8d8359e64fe1043cfca2b162e3e2686002fc40a6d8ebe
- MD5 e8b5e876d86ccdf0b8f3686ab763001f
- SHA1 518b32e2b4934c051bbcbe3db550dc2aade93f3d
- SHA512 3ce9f24dd649367158f54182bbd9eb3297b0eb7a14b1b17998304d106ddcac83a4c55822066afa99c4d7a04d0f35be41aaadccdd30fc51908b66995015a17311
- SSDEEP 98304:wIyatduIyatd/IyatduIyatdHbY6dRnUm8U7:gQdWQdJQdWQd7H18U7
- TLSH T1DD964962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-30_e8b5e876d86ccdf0b8f3686ab763001f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-08-30_e8b5e876d86ccdf0b8f3686ab763001f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-08-30_e8b5e876d86ccdf0b8f3686ab763001f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar_wannacry
- Size 8.4MB
- SHA256 7ca0ee5a3ffd3a5111f8d8359e64fe1043cfca2b162e3e2686002fc40a6d8ebe
- MD5 e8b5e876d86ccdf0b8f3686ab763001f
- SHA1 518b32e2b4934c051bbcbe3db550dc2aade93f3d
- SHA512 3ce9f24dd649367158f54182bbd9eb3297b0eb7a14b1b17998304d106ddcac83a4c55822066afa99c4d7a04d0f35be41aaadccdd30fc51908b66995015a17311
- SSDEEP 98304:wIyatduIyatd/IyatduIyatdHbY6dRnUm8U7:gQdWQdJQdWQd7H18U7
- TLSH T1DD964962720196AAF015EE73C72F7325B8207DA61EA0858FD60D732D1D352F16FB6389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1