General
- Target 2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar
- Size 10.2MB
- Sample260910-nhfc6awsdy
- SHA256 77951d3b60816db6bfdfb3da84ea120df4e47933ae16d6fbf775d479646eb54c
- MD5 bc45df950d00f3525a38a2d3ce94c5d5
- SHA1 4b44adf9f6c5355152a2f6ed77731b274953b869
- SHA512 e3a9a7b972283a0e18ea547e8ac159d73215e1c6e915b4c7c71d3fe6636cbc7813be232efad71c729d196914da0c96a0370831f48248daf7d335b998f6596249
- SSDEEP 98304:5NUgTH2M2m9UMpu1QfLczqssnKSYtAfkZccui+w32+QDENms2p:5+gTH2qBpu1QfLIqsufYAPcui+LjEN0
- TLSH T186B6391172E98FA9C06FD034CE4676A5AA337C418F219FDB09447E293E766E05E3921F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-10_bc45df950d00f3525a38a2d3ce94c5d5_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar
- Size 10.2MB
- SHA256 77951d3b60816db6bfdfb3da84ea120df4e47933ae16d6fbf775d479646eb54c
- MD5 bc45df950d00f3525a38a2d3ce94c5d5
- SHA1 4b44adf9f6c5355152a2f6ed77731b274953b869
- SHA512 e3a9a7b972283a0e18ea547e8ac159d73215e1c6e915b4c7c71d3fe6636cbc7813be232efad71c729d196914da0c96a0370831f48248daf7d335b998f6596249
- SSDEEP 98304:5NUgTH2M2m9UMpu1QfLczqssnKSYtAfkZccui+w32+QDENms2p:5+gTH2qBpu1QfLIqsufYAPcui+LjEN0
- TLSH T186B6391172E98FA9C06FD034CE4676A5AA337C418F219FDB09447E293E766E05E3921F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10- Custom signature
Detects executables packed with ASPack
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Adds Run key to start application