General
- Target 2026-10-02_2af36f1e0d09ee50a66440a1d08a8056_cobalt-strike_elex_hijackloader_icedid_njrat_vidar
- Size 2.0MB
- Sample261003-svt5astsfs
- SHA256 b372866d16e21a076fe198f4da4bc1c060baf69af66848247f059abc588f1e34
- MD5 2af36f1e0d09ee50a66440a1d08a8056
- SHA1 f9ac2af580d2a53b03a9e40b26cc7d64f6252e06
- SHA512 b7bed31fbeb6c9ad1a2f2419fcb1e47de054bf207809c934a2ee550bf2d0b13b4cbdb202198804da221d4fdbf7da721ec96873f51bbfd4184ce9a135010f705d
- SSDEEP 24576:w4R5CIH/7TiGnB9umy20G2gjI45bl9Mbonwap41+zzPTThwv3EJY:wabH/1fu5dgjI45TMwwapIgTI
- TLSH T108A5173272E2049AD6999035DF16863597D13C798FF1D3FBB24572C92B725C03A3AA0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
2026-10-02_2af36f1e0d09ee50a66440a1d08a8056_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
2026-10-02_2af36f1e0d09ee50a66440a1d08a8056_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260911-en
Malware Config
Targets
-
- Target 2026-10-02_2af36f1e0d09ee50a66440a1d08a8056_cobalt-strike_elex_hijackloader_icedid_njrat_vidar
- Size 2.0MB
- SHA256 b372866d16e21a076fe198f4da4bc1c060baf69af66848247f059abc588f1e34
- MD5 2af36f1e0d09ee50a66440a1d08a8056
- SHA1 f9ac2af580d2a53b03a9e40b26cc7d64f6252e06
- SHA512 b7bed31fbeb6c9ad1a2f2419fcb1e47de054bf207809c934a2ee550bf2d0b13b4cbdb202198804da221d4fdbf7da721ec96873f51bbfd4184ce9a135010f705d
- SSDEEP 24576:w4R5CIH/7TiGnB9umy20G2gjI45bl9Mbonwap41+zzPTThwv3EJY:wabH/1fu5dgjI45TMwwapIgTI
- TLSH T108A5173272E2049AD6999035DF16863597D13C798FF1D3FBB24572C92B725C03A3AA0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables service(s)
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1