2026-09-28_36af467599934d37c9088c0a423c8349_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar

General

Target
2026-09-28_36af467599934d37c9088c0a423c8349_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar
Size 3.7MB
Sample260928-vbtersztes
SHA256 a047060f5994ba3b139301e6edccb840d0d7e6e1bc9218de0e9187ad8a4a97fd
MD5 36af467599934d37c9088c0a423c8349
SHA1 18d7dbe45595ae94932051a49064b74f430f4001
SHA512 c14d6aa4b383c8b69bf7e19fdd7e36e39b40a8a9ebe43904374df52fb46fe94c1d7f79a55cc5f5b631596d6a02dd63042ac358eff728cc82420958dbb00c9555
SSDEEP 49152:OjvikOMDRZ9IBVL+s0ezJGd80SHMsThF35Hj1BzuW9Gllgo3Cjvik8:OjVOMDtIXLr06AdfEThF35PzuAE+3jV8
TLSH
T15506E015B7E800A8F0A7A279C9B34562D6B17C120F70DA9F1191B26E3F736914E7DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_36af467599934d37c9088c0a423c8349_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar

File Explorer

2026-09-28_36af467599934d37c9088c0a423c8349_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar

.exe 3.7MB

2026-09-28_36af467599934d37c9088c0a423c8349_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar

IMPHASH 26db5052cd8ede8ee590a842731769c5
SHA256 a047060f5994ba3b139301e6edccb840d0d7e6e1bc9218de0e9187ad8a4a97fd
MD5 36af467599934d37c9088c0a423c8349
SHA1 18d7dbe45595ae94932051a49064b74f430f4001
SHA512 c14d6aa4b383c8b69bf7e19fdd7e36e39b40a8a9ebe43904374df52fb46fe94c1d7f79a55cc5f5b631596d6a02dd63042ac358eff728cc82420958dbb00c9555
SSDEEP 49152:OjvikOMDRZ9IBVL+s0ezJGd80SHMsThF35Hj1BzuW9Gllgo3Cjvik8:OjVOMDtIXLr06AdfEThF35PzuAE+3jV8
TLSH
T15506E015B7E800A8F0A7A279C9B34562D6B17C120F70DA9F1191B26E3F736914E7DF21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15171

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA LockResource LoadResource SizeofResource FindResourceA WideCharToMultiByte MultiByteToWideChar WriteFile DeleteFileA CreateDirectoryA GetProcAddress LoadLibraryA lstrcatA GetSystemTime GetModuleHandleA GetModuleFileNameA GetTempPathA GetFileSize WaitForSingleObject ResumeThread SetThreadPriority CreateThread GetStringTypeA LCMapStringW LCMapStringA SetEndOfFile GetOEMCP GetACP GetCPInfo IsBadCodePtr IsBadReadPtr FlushFileBuffers SetStdHandle SetUnhandledExceptionFilter GetComputerNameA CloseHandle GetFileType GetStdHandle HeapAlloc RtlUnwind GetStartupInfoA GetCommandLineA GetVersion ExitProcess HeapFree RaiseException GetLastError HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc IsBadWritePtr ReadFile TerminateProcess GetCurrentProcess SetFilePointer HeapSize UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStringTypeW

user32

DefWindowProcA PostQuitMessage DestroyWindow CreateWindowExA ShowWindow GetMessageA TranslateMessage DispatchMessageA GetDesktopWindow RegisterClassExA

shell32

SHGetSpecialFolderPathA

advapi32

GetUserNameA

shlwapi

PathFileExistsA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_36af467599934d37c9088c0a423c8349_elex_hijackloader_icedid_njrat_nymaim_rhadamanthys_vidar

kernel32

user32

shell32

advapi32

shlwapi

generic