2026-08-10_025dab2eb714ba8d76b2438c674bf68a_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_025dab2eb714ba8d76b2438c674bf68a_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar
Size 969KB
Sample260810-t4v9dsdk3x
SHA256 bd35fd1b4910cd5801913b28aad61782e49e3e55b01606c0794099317e556d73
MD5 025dab2eb714ba8d76b2438c674bf68a
SHA1 0c41538680f5de1aff78cc0d908bf97de498a81e
SHA512 baa4b67598797e6ddf4e2f361dd41e371c7f3fde98c95d232af6a17a99763b2c24028df82e9f2003d9a01a0d84325145befa03ab582600cae320c2c4666efb64
SSDEEP 12288:JvSeVisKzASeVisKzISeVisKzISeVisKzYSeVisKz:Jv9Via9ViK9ViS9Via9Vi
TLSH
T15B256B4573F914E9E1B7923889A54A12E773BC5907209BDF03A0437AAF236D09D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
sample	disable_win_def

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-10_025dab2eb714ba8d76b2438c674bf68a_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/costura.dll

File Explorer

2026-08-10_025dab2eb714ba8d76b2438c674bf68a_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar

.exe 969KB
costura.dll

.dll 4KB
system.runtime.compilerservices.unsafe.dll

.dll 16KB

2026-08-10_025dab2eb714ba8d76b2438c674bf68a_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 bd35fd1b4910cd5801913b28aad61782e49e3e55b01606c0794099317e556d73
MD5 025dab2eb714ba8d76b2438c674bf68a
SHA1 0c41538680f5de1aff78cc0d908bf97de498a81e
SHA512 baa4b67598797e6ddf4e2f361dd41e371c7f3fde98c95d232af6a17a99763b2c24028df82e9f2003d9a01a0d84325145befa03ab582600cae320c2c4666efb64
SSDEEP 12288:JvSeVisKzASeVisKzISeVisKzISeVisKzYSeVisKz:Jv9Via9ViK9ViS9Via9Vi
TLSH
T15B256B4573F914E9E1B7923889A54A12E773BC5907209BDF03A0437AAF236D09D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Detects executables Discord URL observed in first stage droppers
Detects executables containing artifacts associated with disabling Widnows Defender
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables manipulated with Fody
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

1d:ad:e4:e5:40:80:93:2e:36:31:12:05:66:d6:71:79:b1:2c:b6:99:41:24:84:70:15:8b:e4:92:a5:20:37:29

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,L=New York,ST=New York,C=US

Chains

Oct 20, 2024

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,L=New York,ST=New York,C=US

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,L=New York,ST=New York,C=US

Serial Number

33:00:01:ba:aa:46:cf:ea:1e:7d:e1:a1:21:00:00:00:01:ba:aa

Issuer

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 20, 2024 - Oct 23, 2024

Subject

CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:3c:7f:1b:a0:ca:00:37:45:b9:00:00:00:00:00:3c

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 15, 2024 - Feb 15, 2025

Minor OS version

Major OS version

Entry point

29694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\gitlab-runner\builds\045b7677\0\windows\vpnhostservice\VpnHostService\obj\Release\net48\VpnHostService.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9e0d68e4a15788ca1464ee024b3422cfdf8a68bc9058ad0d9c6bc91614935eed
MD5 d075a47a551e53e27889f83670a581e1
SHA1 5954e332ec7732ba34c27e2d88d154d1919c1b07
SHA512 d2f2ca4358102cb0d3cb90c1cebe9aa2cb2c6fb21facdf3471c50ab72d6ac907e789bb918508539c34c10fc948792c68f67363eb755b80a2343bd72dc9e93c0e
TLSH
T1CA81632193B8067AE9770FB29D7B03516375F921ED32C73F595561096C273248E72B32
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Detects executables Discord URL observed in first stage droppers
Detects executables containing artifacts associated with disabling Widnows Defender
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10210

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\costura\Costura\obj\Release\net40\Costura.pdb

system.runtime.compilerservices.unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3cadcb6b8a7335141c7c357a1d77af1ff49b59b872df494f5025580191d1c0d5
MD5 9a341540899dcc5630886f2d921be78f
SHA1 bab44612721c3dc91ac3d9dfca7c961a3a511508
SHA512 066984c83de975df03eee1c2b5150c6b9b2e852d9caf90cfd956e9f0f7bd5a956b96ea961b26f7cd14c089bc8a27f868b225167020c5eb6318f66e58113efa37
SSDEEP 192:erLXx0hyLsbb3rxVj7WU2WLTYoW4GD5dHnhWgN7acWlbAkWD7DiqnajKs3WoHpZ:Ih06sbbVVPWU2WPY7dHRN77RGlGs3jJZ
TLSH
T18F724B45CBEC4607ED232B7085A8D583FF38A3D75816A32929C5F67C0C9A7C5AF21638
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Detects executables Discord URL observed in first stage droppers
Detects executables containing artifacts associated with disabling Widnows Defender
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Detects executables manipulated with Fody

Digest

5d:cb:7e:a5:69:25:4f:af:a8:12:26:de:6b:e9:9e:73:3e:09:68:df:fb:5d:fe:9e:c2:d5:81:e1:60:48:4c:a4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 20, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

13198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

2026-08-10_025dab2eb714ba8d76b2438c674bf68a_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_vidar

PE Signature issue

mscoree

dotnet

costura.dll

mscoree

dotnet

system.runtime.compilerservices.unsafe.dll

mscoree

dotnet