2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc

General

Target
2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc
Size 867KB
Sample260930-2pfjdstgjc
SHA256 e9d2c428f2fd782ea578b62a6672bc4eef0b5a26004640be2c028882eb39fcbb
MD5 2b1e0ccbd6f53082ef15378e06e5fcbf
SHA1 9563bf69a1a7166ae02d8aff8c13b73f7a12593c
SHA512 188a112ea3b153ac7492e2c0de9495f27c4e3d3d24c75195c8b88b35f490a37f3cd4f757bea978689eb36f8ad008bfb966e8a65f3c28b571839d6e63ae321da4
SSDEEP 12288:17+UmNFsLZoXACyRmrK8p+NhJ2Kcp1oWOvp52WV/ETd4fUw:17YFYZ6CGENf0piHvP2WV/ETOsw
TLSH
T14E158F6AB7EC10F5E07AD277C9165516DE727C1A1B31CBCF03A0865A2F176A08E3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc

2026-09-29_2b1e0ccbd6f53082ef15378e06e5fcbf_cobalt-strike_elex_icedid_luca-stealer_njrat_stealc

.exe 867KB

SHA256 e9d2c428f2fd782ea578b62a6672bc4eef0b5a26004640be2c028882eb39fcbb
MD5 2b1e0ccbd6f53082ef15378e06e5fcbf
SHA1 9563bf69a1a7166ae02d8aff8c13b73f7a12593c
SHA512 188a112ea3b153ac7492e2c0de9495f27c4e3d3d24c75195c8b88b35f490a37f3cd4f757bea978689eb36f8ad008bfb966e8a65f3c28b571839d6e63ae321da4
SSDEEP 12288:17+UmNFsLZoXACyRmrK8p+NhJ2Kcp1oWOvp52WV/ETd4fUw:17YFYZ6CGENf0piHvP2WV/ETOsw
TLSH
T14E158F6AB7EC10F5E07AD277C9165516DE727C1A1B31CBCF03A0865A2F176A08E3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

181586

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths