shodi | 2026-09-11_052ce0c25686199d209d368044d40e00_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_smoke-loader_stealc_tofsee_vidar

General

Target
2026-09-11_052ce0c25686199d209d368044d40e00_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_smoke-loader_stealc_tofsee_vidar
Size 2.9MB
Sample260911-pg5gbsgf99
SHA256 557bc3c864890b88fd45f136f204b1894ba6845749eb83020dadd860fe44ed1c
MD5 052ce0c25686199d209d368044d40e00
SHA1 6f7d621b3a2e8b609b60cc6bc77f6e2dd3ae127f
SHA512 9787e4d95ab2229901f53d910cadb3bbc2b3c5452c78988d54c104d37f4c87770d2af8bc5e3b643f400a61c78ed5c6f8c4059ec93047e2c622a30d730442ca9a
SSDEEP 49152:wIn02cm/7t0i0FZaUm8ciHgjI45TMwwapIgT:p0MnUm8RLapI
TLSH
T1B5D5392772E200A9C19DD075CF46863597E17C798FF1A7EB6240B2D52B72AD0373A70A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm shodi

Detects Shodi worm 1 IoCs

resource	yara_rule
sample	family_shodi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-11_052ce0c25686199d209d368044d40e00_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_smoke-loader_stealc_tofsee_vidar

2026-09-11_052ce0c25686199d209d368044d40e00_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_smoke-loader_stealc_tofsee_vidar

.exe 2.9MB

IMPHASH 77f13bc24efea5a05601b43cf44d1f1a
SHA256 557bc3c864890b88fd45f136f204b1894ba6845749eb83020dadd860fe44ed1c
MD5 052ce0c25686199d209d368044d40e00
SHA1 6f7d621b3a2e8b609b60cc6bc77f6e2dd3ae127f
SHA512 9787e4d95ab2229901f53d910cadb3bbc2b3c5452c78988d54c104d37f4c87770d2af8bc5e3b643f400a61c78ed5c6f8c4059ec93047e2c622a30d730442ca9a
SSDEEP 49152:wIn02cm/7t0i0FZaUm8ciHgjI45TMwwapIgT:p0MnUm8RLapI
TLSH
T1B5D5392772E200A9C19DD075CF46863597E17C798FF1A7EB6240B2D52B72AD0373A70A
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

15703

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths