2026-05-25_f8fff6f32314419e58137fe7494f4387_cobalt-strike_elex_icedid_luca-stealer_mespinoza_njrat_stealc_vidar

General

Target
2026-05-25_f8fff6f32314419e58137fe7494f4387_cobalt-strike_elex_icedid_luca-stealer_mespinoza_njrat_stealc_vidar
Size 1.7MB
Sample260525-rtf1lses4x
SHA256 51f3348df702efa88954b974c0fd2843f5fe31c64280d999422d4f722eeaa59e
MD5 f8fff6f32314419e58137fe7494f4387
SHA1 53157038c08633ae38b17e2d37f41e27127d3aba
SHA512 ba4b11c7f43feeb1eb9439d4d7885d7e5b32b01ee42a5cbb9956cc22f8415010667a91dbcb83a350ae7ce20bf925f3191c3cd9f4477fbf128127e892941c7f6b
SSDEEP 24576:GH35DMw2n/qIjtAT3Gf2ROf1IegqutJQ5FeQzcuC4r6HQ2QRlHUVXkc8DjcSrbPy:O35DMnCIjtAyf2RAR5FeA6w24H9LJ6
TLSH
T1C9855B0177A483FEE9735231C965A272E6717D205930F34F3258FA5E6F32E40996BB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-25_f8fff6f32314419e58137fe7494f4387_cobalt-strike_elex_icedid_luca-stealer_mespinoza_njrat_stealc_vidar

File Explorer

2026-05-25_f8fff6f32314419e58137fe7494f4387_cobalt-strike_elex_icedid_luca-stealer_mespinoza_njrat_stealc_vidar

.exe 1.7MB

2026-05-25_f8fff6f32314419e58137fe7494f4387_cobalt-strike_elex_icedid_luca-stealer_mespinoza_njrat_stealc_vidar

SHA256 51f3348df702efa88954b974c0fd2843f5fe31c64280d999422d4f722eeaa59e
MD5 f8fff6f32314419e58137fe7494f4387
SHA1 53157038c08633ae38b17e2d37f41e27127d3aba
SHA512 ba4b11c7f43feeb1eb9439d4d7885d7e5b32b01ee42a5cbb9956cc22f8415010667a91dbcb83a350ae7ce20bf925f3191c3cd9f4477fbf128127e892941c7f6b
SSDEEP 24576:GH35DMw2n/qIjtAT3Gf2ROf1IegqutJQ5FeQzcuC4r6HQ2QRlHUVXkc8DjcSrbPy:O35DMnCIjtAyf2RAR5FeA6w24H9LJ6
TLSH
T1C9855B0177A483FEE9735231C965A272E6717D205930F34F3258FA5E6F32E40996BB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

177464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Office\Target\x86\ship\postc2r\x-none\clview.pdb

Name

.text

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.c2r

Size

512B

Virtual Size

280B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-25_f8fff6f32314419e58137fe7494f4387_cobalt-strike_elex_icedid_luca-stealer_mespinoza_njrat_stealc_vidar

generic