19248e97c61b6252734c7a6f1fded6c6b8419db313adad37dd92a5cff176010c

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
Size 319KB
Sample260517-tls2baa14s
SHA256 19248e97c61b6252734c7a6f1fded6c6b8419db313adad37dd92a5cff176010c
MD5 a67b5fade733702e311f2914950e7da8
SHA1 97e02a3804f3f7ae640eadfab5477043463d87ee
SHA512 28c80cdc17ac3d49181609e152c1c3e6bd3be2ea70e879d734af7c498e94ec74042cf9e97f5ee53d2d8ac1d1017f101b1e98ae8877be438d325c12566b2e344c
SSDEEP 3072:pmOkuJVLWDCvl29k+ryysDCXKV93Wz82fBJSRAHOisuD85B03eC0D:UuJeCvF+ryyFuKSG7SdD
TLSH
T1E664C303A6EC3CE6D03A8630A77747C0EB2EEC4547A0D58F56D006A5DE3E693792A7D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4748	Logo1_.exe
4472	2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-sl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\misc\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-black\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\edge_game_assist\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Offline\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\config\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\edge_feedback\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Trust Protection Lists\Mu\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\WidevineCdm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\edge_feedback\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\DocumentCard\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\en\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ca-es\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\de\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_neutral_split.scale-100_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sv-se\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\Fonts\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
File created	C:\Windows\Logo1_.exe	2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe
4748	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 1732	3252	2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe	80
PID 3252 wrote to memory of 4748	3252	2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe	81
PID 4748 wrote to memory of 4232	4748	Logo1_.exe	82
PID 4232 wrote to memory of 4412	4232	net.exe	84
PID 1732 wrote to memory of 4472	1732	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a459F.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    - Executes dropped EXE
    PID:4472
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4232
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 128KB
SHA256 a6195ed67f4bd18c4a37405c85231b6ad8a6033eafcb7051d49589f1a4d7611f
MD5 e578086c4a238821ba730ffe84ede043
SHA1 952ee177d199d045012a12c01c45ebd96d5cb118
SHA512 ff012fb57d2fdb9d9b72ea4ace9d90f56ac66657d50743e61266eb26813f82d443ec4dd6aef0532610ee3dfbb15338ac79f77df56d6a1c1da3ab40516072f9e1
SSDEEP 3072:plOkuJVL/YCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:nuJ5YCk3ET+Tu3fCUzB+JHI
TLSH
T156D39D1376D18472E4B1593108A1DE718E3FF9625D98CE6B33D42A3E0F316C1DE26A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 578KB
SHA256 66af1f7dbcc5d1918eedc82b8eab8626ff905b6000c0c9c743669b2a2e3140d0
MD5 c207ce00d9cd30676a65493b3c6c339b
SHA1 19a7cd258f2ff695fbb3677a2dbcd2356a688195
SHA512 7f71c5d32c3ebfae6224a50979d2af9fb7e41eb5d4986f47ff80523247c4d12f52a665039e8bd39711be4db958b0489417d070509d8318b327d463f861322f39
SSDEEP 6144:UuJkXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4w:OXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T103C40916F6748335D073C0B9C5D2A69EE97230825B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 484KB
SHA256 2cd1ea7b5bc267846e0fb1ef348ecef353627fc52d6591b6cba1ff16408e44c8
MD5 6098ea38ec05a4b6b3cfe01ae79052f0
SHA1 6957689ee3f65766a6b340aa4c88587cc38f69ea
SHA512 620e6772ffbf931af5039db5bad754ba62c1756ef050706ae13b0574b73f451aae363497169f01b23052c83eedb3a9b635f012367d0e0923562460ae494e6823
SSDEEP 6144:w7uJMqIuRebMq5S+Ud8AK+ehB9XgdmAeUBZ2x52OoElZTxPhhQgO1Oi9+8Vl9fA4:wNqIOkU8AMXE9B7PElZlP41N+4PUWfo
TLSH
T1DEB47D31E6A04037D6F106B3F925D6307E7DA2187B1184AB9394AE1D3EA8597A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a459F.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a459F.bat
Size 908B
SHA256 1d3d410766f1fb072798034ba4dbfbfc135712f92462ad304bd3b73609288f21
MD5 4777bf5e40cdd57bcc44c93e123f8e1d
SHA1 dc8a149002ddf9c1b61e22d17a6db47b69093301
SHA512 1fa29df4cbb18eb95b2ad042206ac5f92b36e79874716702d63caf2f581756d0f3b8718f3041dab05fbd89991fa22319b68a552397b67d0c6e866b3213cc4e95
TLSH
T1B411061743E7CF5E451112578BFA1D4FC09A7EEB6F87226153C48EAE10D193CA89638E
MD5 SHA1 SHA512 TLSH

Submit Download

2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-17_a67b5fade733702e311f2914950e7da8_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc.exe.exe
Size 290KB
SHA256 c571d6e1595827a2c3b6baeb654ae5be9fa688cdd34fd0bb4453a96ed93590a5
MD5 65d1459dfdf9803e0531c36b91d7be1a
SHA1 8e946bd77490094c92c8b9958d65b3d850d77077
SHA512 28da6993f99ede3fafcaf3b98843db12d8b93f502d28273164d07c89d3edac51935019e50be34f73585ad3cac9db83e00292ab22cabbef13be3fa4047d9ef269
SSDEEP 3072:zDCvl29k+ryysDCXKV93Wz82fBJSRAHOisuD85B03eC0D:HCvF+ryyFuKSG7SdD
TLSH
T13754A143A6EC3CE6D03A8630A77743C0EB2EEC4547A0D58F52D006A5DE3E693792A7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 29KB
SHA256 fc6a14958b74c4b0092e9ce9aafd801d1be275a3cf1a79716a882a91e1fdee9a
MD5 2a900face7f3854755b84c9f46a9de39
SHA1 34add6ffe766ca3e94c97953b9e979603bbff7ce
SHA512 e7dd8eb2b8ebced13c9a9987a2c656328318c63caa2236fde613ba3f71c345285b7f0389ad05706f856550245f66c13bcf117cae500449c7a460aceb74759f85
SSDEEP 384:NbbkHE1Gt5M0zhIV/DZ3KZp7JcTO4yf9Knuf2MqlUV2V9wVfUnfRqOzGOnJh:pmE16GVRu1yK9fMnJG2V9dHS8
TLSH
T136D2BF2B37BE5D5AD1999EF098534FAACF27B522ECCDC14F4E30BA4B0A5170065D2923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-125073035-2952146151-721812867-1000\_desktop.ini
Size 9B
SHA256 72ace29665e300aa419b87ef2ca3544877abf8af2326e8f038cdeaea197d4ca3
MD5 6d8255ce116221e1fbaf70d632e4eb98
SHA1 c3413a7c01858c9bd7ea3abd52ffa903b8f86702
SHA512 33da7b46078aadcdbce21a055b70b967a60803ac9927539621d6e640b7bcedbc20a444d488181cdeb4911e0f958699351eb1ad85b645f088b73e79895e80a518
MD5 SHA1 SHA512

Submit Download

memory/3252-9-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3252-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4748-26-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4748-36-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4748-32-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4748-343-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4748-1223-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4748-19-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4748-5004-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4748-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4748-5495-0x0000000000400000-0x0000000000436000-memory.dmp

Download