shodi | 2026-11-07_bf6e48d1399b75e19cf7c21cc7039e98_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_stop_tofsee_vidar

General

Target
2026-11-07_bf6e48d1399b75e19cf7c21cc7039e98_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_stop_tofsee_vidar
Size 1.5MB
Sample261108-jay33syve1
SHA256 7e764a3017e54eb0fa093000e0730d4e58935ec99ded8583cefa7d2ef8a85f35
MD5 bf6e48d1399b75e19cf7c21cc7039e98
SHA1 ae08b82c159e5e6e464c9336696c39b6579013c6
SHA512 41d7cb20deac0377054b7d47af656f683c0399e726b74aacf741b7357e47b3fb8a45a934df83250be1df8e7e0956e21b7a4887e449d4c6bda0c1aa33057d0723
SSDEEP 24576:aue1hr0TYQeFNS5978AoNjlYjboGxZqwijaahIJpXa:aTr0UJS78AclYvoGxUSJpXa
TLSH
T1CF757C11B3E441B5E077917AC9669726EBB27C115B30C7CF0394A66E1F336E09E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm shodi

Detects Shodi worm 1 IoCs

resource	yara_rule
sample	family_shodi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_bf6e48d1399b75e19cf7c21cc7039e98_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_stop_tofsee_vidar

2026-11-07_bf6e48d1399b75e19cf7c21cc7039e98_cobalt-strike_elex_icedid_njrat_nymaim_rhadamanthys_stop_tofsee_vidar

.exe 1.5MB

IMPHASH 77f13bc24efea5a05601b43cf44d1f1a
SHA256 7e764a3017e54eb0fa093000e0730d4e58935ec99ded8583cefa7d2ef8a85f35
MD5 bf6e48d1399b75e19cf7c21cc7039e98
SHA1 ae08b82c159e5e6e464c9336696c39b6579013c6
SHA512 41d7cb20deac0377054b7d47af656f683c0399e726b74aacf741b7357e47b3fb8a45a934df83250be1df8e7e0956e21b7a4887e449d4c6bda0c1aa33057d0723
SSDEEP 24576:aue1hr0TYQeFNS5978AoNjlYjboGxZqwijaahIJpXa:aTr0UJS78AclYvoGxUSJpXa
TLSH
T1CF757C11B3E441B5E077917AC9669726EBB27C115B30C7CF0394A66E1F336E09E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

15703

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths