2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys_stealc_vidar

General

Target
2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys_stealc_vidar
Size 3.9MB
Sample260928-vhn4mabh65
SHA256 9271af5e005e17f01bf762d657dba64367faa34e3d51e1d3b0bf7b7b751e2544
MD5 30d3b4aaabb2d449283c9adb467ac6f4
SHA1 ec481699673167f7a0705c3497da98983f8d5d3c
SHA512 2000c53407832a4e78e43f3ab4b339f355b989498a4173648e42e972855422acf98651115cf4c07b1dc47eb35f1383e435270b80c27f24fbe543adeacbc4c227
SSDEEP 98304:njiqMDtIXLr06AdfEThF35PzuPxcNSGvYjPKjiO:WmrmEdF32xcNSGiPBO
TLSH
T1CC16F11572E900D8F4A7E13AC9234966D6B13C160F319ADF0290BB5B2F77AD21E7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys_stealc_vidar

File Explorer

2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys_stealc_vidar

.exe 3.9MB

2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys_stealc_vidar

IMPHASH 26db5052cd8ede8ee590a842731769c5
SHA256 9271af5e005e17f01bf762d657dba64367faa34e3d51e1d3b0bf7b7b751e2544
MD5 30d3b4aaabb2d449283c9adb467ac6f4
SHA1 ec481699673167f7a0705c3497da98983f8d5d3c
SHA512 2000c53407832a4e78e43f3ab4b339f355b989498a4173648e42e972855422acf98651115cf4c07b1dc47eb35f1383e435270b80c27f24fbe543adeacbc4c227
SSDEEP 98304:njiqMDtIXLr06AdfEThF35PzuPxcNSGvYjPKjiO:WmrmEdF32xcNSGiPBO
TLSH
T1CC16F11572E900D8F4A7E13AC9234966D6B13C160F319ADF0290BB5B2F77AD21E7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15171

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileA LockResource LoadResource SizeofResource FindResourceA WideCharToMultiByte MultiByteToWideChar WriteFile DeleteFileA CreateDirectoryA GetProcAddress LoadLibraryA lstrcatA GetSystemTime GetModuleHandleA GetModuleFileNameA GetTempPathA GetFileSize WaitForSingleObject ResumeThread SetThreadPriority CreateThread GetStringTypeA LCMapStringW LCMapStringA SetEndOfFile GetOEMCP GetACP GetCPInfo IsBadCodePtr IsBadReadPtr FlushFileBuffers SetStdHandle SetUnhandledExceptionFilter GetComputerNameA CloseHandle GetFileType GetStdHandle HeapAlloc RtlUnwind GetStartupInfoA GetCommandLineA GetVersion ExitProcess HeapFree RaiseException GetLastError HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc IsBadWritePtr ReadFile TerminateProcess GetCurrentProcess SetFilePointer HeapSize UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStringTypeW

user32

DefWindowProcA PostQuitMessage DestroyWindow CreateWindowExA ShowWindow GetMessageA TranslateMessage DispatchMessageA GetDesktopWindow RegisterClassExA

shell32

SHGetSpecialFolderPathA

advapi32

GetUserNameA

shlwapi

PathFileExistsA

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_30d3b4aaabb2d449283c9adb467ac6f4_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat_nymaim_rhadamanthys_stealc_vidar

kernel32

user32

shell32

advapi32

shlwapi

generic