2026-10-01_46f29b2c6c1c3fe1e8868143b3713dd7_akira_cobalt-strike_elex_hijackloader_icedid_ipamor_njrat_remcos_rhadamanthys_vidar
Multi-faceted malware with injection, C2, persistence
Writable entry in a PE with no executable sectionsUnsigned WinExec payload copies a file
SHA-2566f062bea9ffa5931d772a04e4bf27c1e91949a6e24a5c4c83b9c14011c6172e0
Evidence
⋯5 more rows
0x3f000000000000000000000000000000000................
0x400558bec81ec0001000056be000100006aU........V.....j
0x410008d8500ffffff5650e8e22d000083c4.......VP..-....
0x4200c8d8500ffffff56506a00ff1550b040.......VPj...P.@
0x4300085c074266a0068800000006a036a00...t&j.h....j.j.
0x4406a018d8500ffffff5e56680000008050j.......^Vh....P
0x480ec5053568b750833db5753ff7608ff15.PSV.u.3.WS.v...
0x4a076088945f8895e04ffd78d45fc538b1dv..E..^....E.S..
0x4c085c00f842a0100008d45b06a02508d45....*....E.j.P.E
0x4d0f450e8892d00008d45b26a02508d450a.P..-...E.j.P.E.
0x4e050e87a2d000083c418ff75f4e82c0100P.z-......u..,..
0x4f0006639450a74148b4df88326006a0189.f9E.t..M..&.j..
0x5004e0c58894604e90b0100006a026a006aN.X.F......j.j.j
0x510fac70601000000ff7608ffd78d45fc6a........v....E.j
0x52000508d45b06a0250ff7608ffd385c00f.P.E.j.P.v......
0x53084bd0000008d45b06a02508d462050e8......E.j.P.F P.
0x5401c2d000083c40c6a026a006af6ff7608.-.....j.j.j..v.
0x550ffd78d45fc6a00508d45b06a0450ff76...E.j.P.E.j.P.v
0x56008ffd385c00f84870000008d4db08d46............M..F
0x5700c6a045150e8e62c000083c40c6af258.j.QP..,.....j.X
0x5806a026a00508945f0ff7608ffd78d45fcj.j.P.E..v....E.
0x5906a00508d45b06a0450ff7608ffd385c0j.P.E.j.P.v.....
0x5a074508d4db08d46186a045150e8af2c00tP.M..F.j.QP..,.
0x5b0008b4e1883c40c85c976128b45f86af2..N......v..E.j.
0x5c02bc183e80e89461c582bc1eb038b45f0+.....F.X+....E.
0x5d06a0283c0fc6a0050ff7608ffd78d45fcj....j.P.v....E.
0x5e06a00508d45b06a0450ff7608ffd385c0j.P.E.j.P.v.....
0x5f0750433c0eb208d45b08d7e106a045057u.3.. .E..~.j.PW
0x600e85b2c000083c40c833f0076068b460c.[,......?.v..F.
0x6108946146a01585f5e5bc9c204008b4424.F.j.X_^[.....D$
0x620045605fedfffff33c96a0f8acc5e8ad0.V.....3.j...^..
0x63023ce23d6c1e10403ca668bd0c1e10466#.#......f.....f
0x640c1ea0c03cac0e804c1e10423c603c8f7...........#....
0x650d183c1058ac1668bd123c6c1e00466c1......f..#....f.
0x660ea0c03c233d28ad5c1e00423d603c2c0....3......#....
0x670e904c1e00423ce5e03c1c20400515153.....#.^.....QQS
⋯3 more rows
0xa5380b000080390000803400008000000000....9...4.......
0xa5485753325f33322e646c6c000034004372WS2_32.dll..4.Cr
0xa5586561746546696c65410024014765744deateFileA.$.GetM
⋯7 more rows
0xa5d87d0147657457696e646f777344697265}.GetWindowsDire
0xa5e863746f7279410000630147657454656dctoryA..c.GetTem
0xa5f87046696c654e616d65410000fe015072pFileNameA....Pr
0xa6086f6365737333324e657874009e025465ocess32Next...Te
0xa618726d696e61746550726f636573730000rminateProcess..
0xa628ef014f70656e50726f6365737300fc01..OpenProcess...
0xa63850726f63657373333246697273740000Process32First..
0xa6484c00437265617465546f6f6c68656c70L.CreateToolhelp
0xa6583332536e617073686f740000f700476532Snapshot....Ge
0xa6687443757272656e7450726f6365737300tCurrentProcess.
0xa678750147657456657273696f6e45784100u.GetVersionExA.
0xa688570044656c65746546696c654100d302W.DeleteFileA...
⋯10 more rows
0xa7386d6573410000ac00466c757368566965mesA....FlushVie
0xa748774f6646696c6500c3014c6f61644c69wOfFile...LoadLi
0xa758627261727945784100006c0253657446braryExA..l.SetF
0xa768696c6554696d65009602536c65657000ileTime...Sleep.
0xa7782800436f707946696c65410014014765(.CopyFileA...Ge
⋯8 more rows
0xab74520147657457696e646f770014025365R.GetWindow...Se
0xab846e644d6573736167654100005e014765ndMessageA..^.Ge
0xab947457696e646f77546578744100006201tWindowTextA..b.
0xaba447657457696e646f7754687265616450GetWindowThreadP
0xabb4726f63657373496400008f0149735769rocessId....IsWi
0xabc46e646f7700005553455233322e646c6cndow..USER32.dll
0xabd400005b01526567436c6f73654b657900..[.RegCloseKey.
0xabe4860152656753657456616c7565457841..RegSetValueExA
0xabf400005e015265674372656174654b6579..^.RegCreateKey
0xac04410071015265674f70656e4b65794100A.q.RegOpenKeyA.
0xac14170041646a757374546f6b656e507269..AdjustTokenPri
0xac2476696c6567657300f5004c6f6f6b7570vileges...Lookup
0xac3450726976696c65676556616c75654100PrivilegeValueA.
0xac4442014f70656e50726f63657373546f6bB.OpenProcessTok
0xac54656e000041445641504933322e646c6cen..ADVAPI32.dll
0xac6400000a00566572517565727956616c75....VerQueryValu
⋯7 more rows
⋯9 more rows
0xae60766963657300000057444d004d535744vices...WDM.MSWD
0xae704d2e455845000000536f667477617265M.EXE...Software
0xae805c4d6963726f736f66745c57696e646f\Microsoft\Windo
0xae9077735c43757272656e7456657273696fws\CurrentVersio
0xaea06e5c52756e0000005c6d7377646d2e65n\Run...\mswdm.e
0xaeb0786500002120000021000000202d7221xe..! ..!... -r!
0xaec000000000646576696365000053655368....device..SeSh
0xaed07574646f776e50726976696c65676500utdownPrivilege.
0xaee02d7200002d6e00002d7400002d650000-r..-n..-t..-e..
⋯10 more rows
0xaf906cd04000d0d14000c4d14000b8d14000l.@...@...@...@.
0xafb02e455845000000004e4554455945532e.EXE....NETEYES.
0xafc0455845004d534445562e455845000000EXE.MSDEV.EXE...
0xafd04558504c4f5245522e45584500000000EXPLORER.EXE....
0xafe058585858585858585858585858585858XXXXXXXXXXXXXXXX
0xaff058585858585858582e45584500000000XXXXXXXX.EXE....
0xb000495041524d4f520054524f4a414e0000IPARMOR.TROJAN..
0xb0103235352e3235352e3235352e32353500255.255.255.255.
0xb020c4bec2ed00000000c5b5b6d900000000................
0xb0304e4f52544f4e00004649524557414c4cNORTON..FIREWALL
0xb04000000000c8f0d0c700000000b7c0bbf0................
0xb050c7bd0000bdf0c9bdcdf8efda00000000................
0xb0605c77656c636f6d652e65786500000000\welcome.exe....
0xb0704d4943524f534f46540000005c537472MICROSOFT...\Str
0xb080696e6746696c65496e666f5c25303478ingFileInfo\%04x
0xb090253034785c436f6d70616e794e616d65%04x\CompanyName
0xb0a0000000005c56617246696c65496e666f....\VarFileInfo
0xb0b05c5472616e736c6174696f6e00000000\Translation....
0xb0c04765744d6f64756c6546696c654e616dGetModuleFileNam
⋯3 more rows
0x39ae682e0064006c006c000000000000000000..d.l.l.........
0x39ae785265674f70656e4b65795472616e7361RegOpenKeyTransa
0x39ae8863746564570000005265674372656174ctedW...RegCreat
0x39ae98654b65795472616e7361637465645700eKeyTransactedW.
0x39aea852656744656c6574654b65795472616eRegDeleteKeyTran
0x39aeb87361637465645700410064006f006200sactedW.A.d.o.b.
0x39aec865002e00570065006200320050004400e...W.e.b.2.P.D.
⋯7 more rows