General
- Target 2026-09-08_710aa79fabde6beccf0149f57ba43696_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 6.0MB
- Sample260908-tc6wtattev
- SHA256 237850019fc706e5a7d2fb0cc6bdd1dfa249547f8fb76922bad46813eff2920c
- MD5 710aa79fabde6beccf0149f57ba43696
- SHA1 8a35925e79a06256f9c29d79f2ae47ff9021c863
- SHA512 68d8264fbc1c2d344e0012eb84814c0e940851be5c215e5fad1561039b7b680802745262676414d321fe06b758d5d734593b07d6ebb120c327051feec5accd70
- SSDEEP 49152:wabH/7abH/DI1s+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyqabH/mabX:iI1d0oAaldmdmnpnI1d0oAaldmdmnpdw
- TLSH T103565913A29544E9D15AC074DE06C232EB227C6D47F1A5FF3280BAD93A33AD17B39716
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-09-08_710aa79fabde6beccf0149f57ba43696_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-09-08_710aa79fabde6beccf0149f57ba43696_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-09-08_710aa79fabde6beccf0149f57ba43696_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 6.0MB
- SHA256 237850019fc706e5a7d2fb0cc6bdd1dfa249547f8fb76922bad46813eff2920c
- MD5 710aa79fabde6beccf0149f57ba43696
- SHA1 8a35925e79a06256f9c29d79f2ae47ff9021c863
- SHA512 68d8264fbc1c2d344e0012eb84814c0e940851be5c215e5fad1561039b7b680802745262676414d321fe06b758d5d734593b07d6ebb120c327051feec5accd70
- SSDEEP 49152:wabH/7abH/DI1s+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyqabH/mabX:iI1d0oAaldmdmnpnI1d0oAaldmdmnpdw
- TLSH T103565913A29544E9D15AC074DE06C232EB227C6D47F1A5FF3280BAD93A33AD17B39716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1