General
- Target 2026-08-02_6637893b468796cbf688fae4158d5589_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 3.9MB
- Sample260802-ww87dsdr61
- SHA256 ec21f5aa188122f0d4a11bcb5af442f4cee622a7e58e64c24f4640e1a92151c4
- MD5 6637893b468796cbf688fae4158d5589
- SHA1 bc8860f7e5119119b1eda54037775706ba0d70cc
- SHA512 32bc7ef5253609959cedda40b51ad853684b276ed89124e4425fcdb77dc77ab7d8f626b02fa5597610af5455015be66e2d69016abfe4f1e40d906d7249ba28a9
- SSDEEP 98304:kxQeMjLsAAa/7JNzJwjI5klUigKYkBEvHI:LeGZF6bUpMBz
- TLSH T1AC161226F6A44076D0339139C9D2E326EA353DA1573086CB93C15B6D5F336E2A93E732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_6637893b468796cbf688fae4158d5589_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_6637893b468796cbf688fae4158d5589_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-02_6637893b468796cbf688fae4158d5589_cobalt-strike_elex_hijackloader_luca-stealer_njrat_remcos_smoke-loader_vidar
- Size 3.9MB
- SHA256 ec21f5aa188122f0d4a11bcb5af442f4cee622a7e58e64c24f4640e1a92151c4
- MD5 6637893b468796cbf688fae4158d5589
- SHA1 bc8860f7e5119119b1eda54037775706ba0d70cc
- SHA512 32bc7ef5253609959cedda40b51ad853684b276ed89124e4425fcdb77dc77ab7d8f626b02fa5597610af5455015be66e2d69016abfe4f1e40d906d7249ba28a9
- SSDEEP 98304:kxQeMjLsAAa/7JNzJwjI5klUigKYkBEvHI:LeGZF6bUpMBz
- TLSH T1AC161226F6A44076D0339139C9D2E326EA353DA1573086CB93C15B6D5F336E2A93E732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE