General
- Target 2026-08-03_9c8be27d595bf9aa93b598b437b33814_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar
- Size 2.7MB
- Sample260803-vysrrach37
- SHA256 bbf63e01ef1f2cd4895aa9fb6fc24ba0a54164161b736934a2c4876b0bc0764f
- MD5 9c8be27d595bf9aa93b598b437b33814
- SHA1 1be8b506e091c26ce442e0b81af6987e38db3e46
- SHA512 d292e9d8e0252d949b405992f2f372524f6481474cab9034d4f21fc936f21a9a0c4305eb5c21e2c75ff18c1cd7262c8375afb6a0198715493164be479055b460
- SSDEEP 24576:gdSHL8bvuA6GRIdbfbqO4YskoVVtE4i0ZJp0Rsivg+6h55H863IXSHaxA:gdSHLtAnRWgHFVdDZDfivg+6h+SHae
- TLSH T196D5D60273F907D9F1F34B7849766A5598B6BCA9DA10C39F15A0710E0E32B948C76B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_9c8be27d595bf9aa93b598b437b33814_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_9c8be27d595bf9aa93b598b437b33814_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar.exe
Resource
win11ltsc2024-20260709-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_9c8be27d595bf9aa93b598b437b33814_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_stealc_vidar
- Size 2.7MB
- SHA256 bbf63e01ef1f2cd4895aa9fb6fc24ba0a54164161b736934a2c4876b0bc0764f
- MD5 9c8be27d595bf9aa93b598b437b33814
- SHA1 1be8b506e091c26ce442e0b81af6987e38db3e46
- SHA512 d292e9d8e0252d949b405992f2f372524f6481474cab9034d4f21fc936f21a9a0c4305eb5c21e2c75ff18c1cd7262c8375afb6a0198715493164be479055b460
- SSDEEP 24576:gdSHL8bvuA6GRIdbfbqO4YskoVVtE4i0ZJp0Rsivg+6h55H863IXSHaxA:gdSHLtAnRWgHFVdDZDfivg+6h+SHae
- TLSH T196D5D60273F907D9F1F34B7849766A5598B6BCA9DA10C39F15A0710E0E32B948C76B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application