General
- Target 2026-09-08_87df7bc4842285f7223737d6f145bb56_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 1.4MB
- Sample260910-ey23eszvbs
- SHA256 c751cb8c794b9e4eaacec8894880c1bf1623d5b5057ee180e9e776edece159db
- MD5 87df7bc4842285f7223737d6f145bb56
- SHA1 f3ce4e7a6bc18eebb99f7662700e19a7e9b74b4b
- SHA512 4b5bfc3f390ed8fa0ad4cee7d09a7cfd350b3a04a016bfda5c0df1d38956c967e79581ce644afac310c9582c11b2db689a2aabcdb45084806434cfae8794ecea
- SSDEEP 24576:w4R5CIH/7v4R5CIH/7vI153tTuRWFsronbEqa6+GG8yKrO4cs:wabH/7abH/DI15tTToonbXaIHy5U
- TLSH T1DB659E27B78450E9E066C5709E658236E9727C720B60ADDF13C0B3192E73AE1BB7531B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-09-08_87df7bc4842285f7223737d6f145bb56_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2026-09-08_87df7bc4842285f7223737d6f145bb56_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target 2026-09-08_87df7bc4842285f7223737d6f145bb56_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar
- Size 1.4MB
- SHA256 c751cb8c794b9e4eaacec8894880c1bf1623d5b5057ee180e9e776edece159db
- MD5 87df7bc4842285f7223737d6f145bb56
- SHA1 f3ce4e7a6bc18eebb99f7662700e19a7e9b74b4b
- SHA512 4b5bfc3f390ed8fa0ad4cee7d09a7cfd350b3a04a016bfda5c0df1d38956c967e79581ce644afac310c9582c11b2db689a2aabcdb45084806434cfae8794ecea
- SSDEEP 24576:w4R5CIH/7v4R5CIH/7vI153tTuRWFsronbEqa6+GG8yKrO4cs:wabH/7abH/DI15tTToonbXaIHy5U
- TLSH T1DB659E27B78450E9E066C5709E658236E9727C720B60ADDF13C0B3192E73AE1BB7531B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Disables service(s)
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1