General
- Target 2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn
- Size 516KB
- Sample260910-p52qcaxvbx
- SHA256 542b07411fb5753d5c3fdef8ad07f37b9391c4b0952c5408e1f52aa09fa89cd0
- MD5 9d98583fe0063593a8ccd04fc1b5a8bf
- SHA1 0cda6cee076db30ce8c76c978620a89e2036ec8a
- SHA512 d6f026c7519436a8e44e67702149d0d67cded85cbdc7980f83a4bc34b764d4dd91f41801ff32f208c114ea86082a93a6af2440991ad904934748419c858ee60f
- SSDEEP 6144:UsLqdufVUNDafAWz4f1Q8XX/WXsR6+DyPUT6aW7KZWpYFXDsBRHJeqD:PFUNDafCQ8XXT6+WPUT6aWzCFzwHJeO
- TLSH T146B48E13FB9540FAE527C5B448568516FA227C2607A0AACB33A5BF453E336D27E7D302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
Resource
win10v2004-20260513-en
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn.exe
Resource
win11ltsc2024-20260709-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-10_9d98583fe0063593a8ccd04fc1b5a8bf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc_swisyn
- Size 516KB
- SHA256 542b07411fb5753d5c3fdef8ad07f37b9391c4b0952c5408e1f52aa09fa89cd0
- MD5 9d98583fe0063593a8ccd04fc1b5a8bf
- SHA1 0cda6cee076db30ce8c76c978620a89e2036ec8a
- SHA512 d6f026c7519436a8e44e67702149d0d67cded85cbdc7980f83a4bc34b764d4dd91f41801ff32f208c114ea86082a93a6af2440991ad904934748419c858ee60f
- SSDEEP 6144:UsLqdufVUNDafAWz4f1Q8XX/WXsR6+DyPUT6aW7KZWpYFXDsBRHJeqD:PFUNDafCQ8XXT6+WPUT6aWzCFzwHJeO
- TLSH T146B48E13FB9540FAE527C5B448568516FA227C2607A0AACB33A5BF453E336D27E7D302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies visibility of hidden/system files in Explorer
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2