General
- Target 2026-07-10_1ab1297c3bd1f0e0660f10111c1c8d1c_cobalt-strike_elex_luca-stealer_medusalocker_njrat_remcos
- Size 641KB
- Sample260710-mpqa9shz8k
- SHA256 44bec5ae0045b0f4af83fdd4bdc3ba3d0aea831f6136e8d7ea96b949ec57369e
- MD5 1ab1297c3bd1f0e0660f10111c1c8d1c
- SHA1 222565d996f10dab770d34b012892790c62fcd21
- SHA512 50f251dab01cbbd9b860aff18aa93dfd29b84fe74bdcd67ebf80b1f048357e275288b51dad5e6cd723147c6148e3be6430cf80a87719a0a3c4518f8f6650aa41
- SSDEEP 12288:gWgv9fTDlpi7nYDBdz2i95FGsNeFm42fRH/J+PhyKyVkKB0Hazq6evtsY:gwnYDBdiixe5QH+Ij4aq6evts
- TLSH T182D47C207AE5C43AF5B357706E7EDAAA042DBE640F3984EB77C4492D28705C25A71F23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_1ab1297c3bd1f0e0660f10111c1c8d1c_cobalt-strike_elex_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_1ab1297c3bd1f0e0660f10111c1c8d1c_cobalt-strike_elex_luca-stealer_medusalocker_njrat_remcos.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-10_1ab1297c3bd1f0e0660f10111c1c8d1c_cobalt-strike_elex_luca-stealer_medusalocker_njrat_remcos
- Size 641KB
- SHA256 44bec5ae0045b0f4af83fdd4bdc3ba3d0aea831f6136e8d7ea96b949ec57369e
- MD5 1ab1297c3bd1f0e0660f10111c1c8d1c
- SHA1 222565d996f10dab770d34b012892790c62fcd21
- SHA512 50f251dab01cbbd9b860aff18aa93dfd29b84fe74bdcd67ebf80b1f048357e275288b51dad5e6cd723147c6148e3be6430cf80a87719a0a3c4518f8f6650aa41
- SSDEEP 12288:gWgv9fTDlpi7nYDBdz2i95FGsNeFm42fRH/J+PhyKyVkKB0Hazq6evtsY:gwnYDBdiixe5QH+Ij4aq6evts
- TLSH T182D47C207AE5C43AF5B357706E7EDAAA042DBE640F3984EB77C4492D28705C25A71F23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Downloads MZ/PE file
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.