General
- Target 2026-08-27_904aa1469570ea19cfd18317e5492662_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn
- Size 518KB
- Sample260827-p1zeesvdqb
- SHA256 d82de8d3ed7fa09e28948954077f48578d0d74e0e40f9138fe563ce3660ce687
- MD5 904aa1469570ea19cfd18317e5492662
- SHA1 a4c59062a624b2c57f2fcd04e401a3d9652393cd
- SHA512 453e883cc064feaea33db93e7fcdc6ba50801d589722b95506975958f7e85c687ac9fa5bd2fc7e039e47bed76c19b4af15fdc58c0cd158c513bb7c35b1b4b4a2
- SSDEEP 6144:UsLqdufVUNDafAFThYXxt/WgyaNmbXMHupIeIKp+XDsBRHJeqk:PFUNDafKYXxtrmTMHupIeizwHJep
- TLSH T1E3B48E23F69500FAE56386B589568916FA227C260760B9CB33A16F463F332D17E7D313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-27_904aa1469570ea19cfd18317e5492662_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
Resource
win10v2004-20260513-en
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-27_904aa1469570ea19cfd18317e5492662_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
Resource
win11ltsc2024-20260709-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-27_904aa1469570ea19cfd18317e5492662_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn
- Size 518KB
- SHA256 d82de8d3ed7fa09e28948954077f48578d0d74e0e40f9138fe563ce3660ce687
- MD5 904aa1469570ea19cfd18317e5492662
- SHA1 a4c59062a624b2c57f2fcd04e401a3d9652393cd
- SHA512 453e883cc064feaea33db93e7fcdc6ba50801d589722b95506975958f7e85c687ac9fa5bd2fc7e039e47bed76c19b4af15fdc58c0cd158c513bb7c35b1b4b4a2
- SSDEEP 6144:UsLqdufVUNDafAFThYXxt/WgyaNmbXMHupIeIKp+XDsBRHJeqk:PFUNDafKYXxtrmTMHupIeizwHJep
- TLSH T1E3B48E23F69500FAE56386B589568916FA227C260760B9CB33A16F463F332D17E7D313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2