2026-08-04_e949c78fe12940a7b818f0968c85a8a5_cobalt-strike_elex_floxif_luca-stealer_medusalocker_njrat_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_e949c78fe12940a7b818f0968c85a8a5_cobalt-strike_elex_floxif_luca-stealer_medusalocker_njrat_remcos
Size 377KB
Sample260805-aehgfstdlg
SHA256 02c0b45f10b433d9678945d0038aefd607e742a3fb3b4697d5cb03a8bd412aa8
MD5 e949c78fe12940a7b818f0968c85a8a5
SHA1 92187b38666e5b22a4a77560d07a6b9b35e90caa
SHA512 927c81053426aa924b451ae7829991241250b861cb544a60e9c1a42a7a4b67cf2ae4dee0d9467973d3b9f800fb22d6c27edca345b75c3f73e04d3f4742e06ee5
SSDEEP 6144:zdmnT0NGcQi074pg4YsEaZKj/ZHhRUgbhIj8SajIxIHr5EN+WVcYxG/wTFBV+Udn:JK4GcQi0kpg3aQjh9hM1sr5ENpVcIG/y
TLSH
T10A84C0123680C7F6C26305322D78A76955FEB93C0F3652AB6394122DEFBC1D1AA35727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-04_e949c78fe12940a7b818f0968c85a8a5_cobalt-strike_elex_floxif_luca-stealer_medusalocker_njrat_remcos

File Explorer

2026-08-04_e949c78fe12940a7b818f0968c85a8a5_cobalt-strike_elex_floxif_luca-stealer_medusalocker_njrat_remcos

.exe 377KB

2026-08-04_e949c78fe12940a7b818f0968c85a8a5_cobalt-strike_elex_floxif_luca-stealer_medusalocker_njrat_remcos

IMPHASH abefdc83be98544e9e9a726d56273d70
SHA256 02c0b45f10b433d9678945d0038aefd607e742a3fb3b4697d5cb03a8bd412aa8
MD5 e949c78fe12940a7b818f0968c85a8a5
SHA1 92187b38666e5b22a4a77560d07a6b9b35e90caa
SHA512 927c81053426aa924b451ae7829991241250b861cb544a60e9c1a42a7a4b67cf2ae4dee0d9467973d3b9f800fb22d6c27edca345b75c3f73e04d3f4742e06ee5
SSDEEP 6144:zdmnT0NGcQi074pg4YsEaZKj/ZHhRUgbhIj8SajIxIHr5EN+WVcYxG/wTFBV+Udn:JK4GcQi0kpg3aQjh9hM1sr5ENpVcIG/y
TLSH
T10A84C0123680C7F6C26305322D78A76955FEB93C0F3652AB6394122DEFBC1D1AA35727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

64:75:65:ff:40:d3:88:82:d5:4f:3b:6b:c7:9a:ec:b9:04:78:2b:96:02:da:af:d8:98:3e:1d:2a:55:8e:fc:5a

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=110-81-41568,CN=KOREA INFORMATION CERTIFICATE AUTHORITY\, INCORPORATED,OU=IT,O=KOREA INFORMATION CERTIFICATE AUTHORITY\, INCORPORATED,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Sep 19, 2022

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

Serial Number

d1:a5:7c:17:ae:0a:2d:f7:12:b4:2e:ab:77:41:cc:b0

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 15, 2021 - Dec 27, 2024

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

15141

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW WTSSendMessageW

kernel32

TerminateProcess WaitForSingleObject QueueUserWorkItem CreateToolhelp32Snapshot CreateEventW Sleep GetLastError GetCurrentProcess SetEvent Process32FirstW CloseHandle WTSGetActiveConsoleSessionId lstrcmpW GetExitCodeProcess GetModuleFileNameW GetStartupInfoW WideCharToMultiByte MultiByteToWideChar GetACP GetCPInfo GetSystemDirectoryA GetCurrentDirectoryA GetVersionExW GetCurrentThreadId OutputDebugStringA ReleaseSemaphore InterlockedPopEntrySList QueryDepthSList UnregisterWaitEx CreateTimerQueue LoadLibraryW Process32NextW RtlUnwind DuplicateHandle VirtualProtect UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount GetProcAddress EncodePointer RaiseException InterlockedPushEntrySList InterlockedFlushSList FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType GetCurrentThread GetStringTypeW ReadFile SetFilePointerEx CompareStringW LCMapStringW GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW GetProcessHeap WaitForSingleObjectEx CreateThread SetStdHandle CreateFileW FlushFileBuffers GetConsoleCP GetConsoleMode ReadConsoleW HeapSize HeapReAlloc SetEndOfFile WriteConsoleW DecodePointer SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA VirtualAlloc VirtualFree

advapi32

QueryServiceStatus CloseServiceHandle OpenSCManagerW DeleteService ControlService OpenServiceW DeregisterEventSource SetServiceStatus RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW RegisterEventSourceW ReportEventW RevertToSelf OpenProcessToken CreateProcessAsUserW DuplicateTokenEx GetTokenInformation CreateServiceW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_e949c78fe12940a7b818f0968c85a8a5_cobalt-strike_elex_floxif_luca-stealer_medusalocker_njrat_remcos

PE Signature issue

userenv

wtsapi32

kernel32

advapi32

generic