shodi | 2026-11-01_40e058db2fdb784b0dc6bd630668ca5d_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar

General

Target
2026-11-01_40e058db2fdb784b0dc6bd630668ca5d_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar
Size 2.4MB
Sample261104-adthbsgs7n
SHA256 6e85b3616502e7c885a27458230d2d928b63427d05f0c13f48d3b0256d206bf6
MD5 40e058db2fdb784b0dc6bd630668ca5d
SHA1 6fda708eed2d11893a4699827a207e7ad56a5c43
SHA512 aee76b123f953b2337262560db8ea441e04c604c879957020708a692111204306e73e614af702cc5fbb8ba799755eccea4d8de864c94026d558545907c7516fc
SSDEEP 24576:Pl+Cq99Ly4CzH8WAgjI45bl9Mbonwap41+zzPTThwv3EJf:Pl+Cq99LyHHEgjI45TMwwapIgTv
TLSH
T1C9C5172271E200A9C58DD075DF4A963597D23C7D8FF192FBB145B2C92B729D03B39A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm shodi

Detects Shodi worm 1 IoCs

resource	yara_rule
sample	family_shodi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_40e058db2fdb784b0dc6bd630668ca5d_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar

2026-11-01_40e058db2fdb784b0dc6bd630668ca5d_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar

.exe 2.4MB

SHA256 6e85b3616502e7c885a27458230d2d928b63427d05f0c13f48d3b0256d206bf6
MD5 40e058db2fdb784b0dc6bd630668ca5d
SHA1 6fda708eed2d11893a4699827a207e7ad56a5c43
SHA512 aee76b123f953b2337262560db8ea441e04c604c879957020708a692111204306e73e614af702cc5fbb8ba799755eccea4d8de864c94026d558545907c7516fc
SSDEEP 24576:Pl+Cq99Ly4CzH8WAgjI45bl9Mbonwap41+zzPTThwv3EJf:Pl+Cq99LyHHEgjI45TMwwapIgTv
TLSH
T1C9C5172271E200A9C58DD075DF4A963597D23C7D8FF192FBB145B2C92B729D03B39A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

15703

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths