2026-07-01_4c4b2a7f141de87724a1f5cfe940279e_cobalt-strike_elex_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-01_4c4b2a7f141de87724a1f5cfe940279e_cobalt-strike_elex_luca-stealer_medusalocker_njrat_remcos
Size 637KB
Sample260702-aj3cesh121
SHA256 f8d092575cc86ce1c9e42c05f7fa0c586d13f00e07abe56e7739a8094468eb59
MD5 4c4b2a7f141de87724a1f5cfe940279e
SHA1 01d1eb56ab15e5221cf4e09154039e9dc580301c
SHA512 872f70de907fa5cec06d1160c5b98375afb8fac485e82954f751637eb88110db7b1fec3bfa22f84738eb83481e40404536d0c3f44cff2320a8373fa14a4f3958
SSDEEP 12288:VVv9x0ySmPuMn9WGk7JO5sHsA8JIQIie27CL/hyKyVkKB0HavqDOQwb:IMn9WGOJD8rIJzLYj4GqDOQw
TLSH
T1D0D47C217AE5C03AF5B357306EBEDAAA182DBD640F3480DB7BD4492E19705C25A71B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-01_4c4b2a7f141de87724a1f5cfe940279e_cobalt-strike_elex_luca-stealer_medusalocker_njrat_remcos

.exe 637KB

2026-07-01_4c4b2a7f141de87724a1f5cfe940279e_cobalt-strike_elex_luca-stealer_medusalocker_njrat_remcos

IMPHASH 428885d7d4236858238ec9ac2b6d9c88
SHA256 f8d092575cc86ce1c9e42c05f7fa0c586d13f00e07abe56e7739a8094468eb59
MD5 4c4b2a7f141de87724a1f5cfe940279e
SHA1 01d1eb56ab15e5221cf4e09154039e9dc580301c
SHA512 872f70de907fa5cec06d1160c5b98375afb8fac485e82954f751637eb88110db7b1fec3bfa22f84738eb83481e40404536d0c3f44cff2320a8373fa14a4f3958
SSDEEP 12288:VVv9x0ySmPuMn9WGk7JO5sHsA8JIQIie27CL/hyKyVkKB0HavqDOQwb:IMn9WGOJD8rIJzLYj4GqDOQw
TLSH
T1D0D47C217AE5C03AF5B357306EBEDAAA182DBD640F3480DB7BD4492E19705C25A71B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

09:8d:f7:4d:22:4e:b4:83:f7:65:9a:62:07:ea:4c:86:38:db:c7:ca:e8:5f:9a:5a:04:6c:3b:b8:d8:44:c4:77

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=NVIDIA Corporation,OU=1005bk6,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Chains

Jun 8, 2026

CN=NVIDIA Corporation,OU=1005bk6,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=NVIDIA Corporation,OU=1005bk6,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=NVIDIA Corporation,OU=1005bk6,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Serial Number

09:57:1b:5d:ad:70:aa:d1:93:f4:c2:3c:82:a6:6d:e3

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 2, 2025 - Jul 5, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

150336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\dvs\p4\build\sw\dev\gpu_drv\installer_core\installer_core_vs2017\Build\Core\Out\Win32\Release\setup.pdb

kernel32

CreateEventW GetCurrentProcess RaiseException DecodePointer CloseHandle SetLastError DebugBreak Sleep IsDebuggerPresent SetDefaultDllDirectories EnterCriticalSection LeaveCriticalSection GetVersionExW LocalFree FormatMessageW InitializeCriticalSectionEx GetLastError DeleteCriticalSection WideCharToMultiByte GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FindResourceExW FindResourceW LoadResource LockResource SetErrorMode SizeofResource WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW FreeLibrary GetModuleFileNameW GetModuleHandleExW GetProcAddress LoadLibraryW MultiByteToWideChar SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindNextFileW GetFileAttributesW GetTempPathW GetCurrentThread GetTickCount GetSystemDirectoryW lstrcmpW DuplicateHandle TerminateProcess ExpandEnvironmentStringsW LocalAlloc VerSetConditionMask GetFullPathNameW GetModuleFileNameA GetModuleHandleA GetModuleHandleW LoadLibraryExW VerifyVersionInfoW GetSystemInfo TryEnterCriticalSection GetCurrentThreadId QueryPerformanceCounter InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime OutputDebugStringW SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait EncodePointer GetThreadTimes FreeLibraryAndExitThread VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue RtlUnwind ExitProcess GetStdHandle WriteFile GetACP GetFileType LCMapStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA

user32

MessageBoxW

advapi32

OpenProcessToken GetTokenInformation RegOpenCurrentUser RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW RegCloseKey RegQueryValueExW RegSetValueExW LsaNtStatusToWinError

ole32

CoUninitialize CoInitializeSecurity CoInitializeEx

oleaut32

SafeArrayGetVartype SafeArrayCopy SafeArrayLock SafeArrayGetLBound SafeArrayGetUBound SafeArrayUnlock SafeArrayCreate VariantClear VariantInit SafeArrayDestroy SysStringLen VariantChangeType SysAllocStringLen SysAllocString SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-01_4c4b2a7f141de87724a1f5cfe940279e_cobalt-strike_elex_luca-stealer_medusalocker_njrat_remcos

kernel32

user32

advapi32

ole32

oleaut32

generic