General
- Target 2026-04-18_30ff1bef4ed7de84455a170656695319_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 32.4MB
- Sample260418-e7hp5sax3r
- SHA256 d548b01c2304b07b4b6ff75fccd53a173cefaee0b4607e2ea7bd670ccbf7f95d
- MD5 30ff1bef4ed7de84455a170656695319
- SHA1 30189b375b86691a0bf55e7fee5acf312b7f6a04
- SHA512 e8e83470448bfd125afab7000887e8c8647a1953a1367eb344b2582426ca49d52a3bb3164c5a0af216d57a5d70b4829ad197ca4b137827b9d850b350c902a174
- SSDEEP 393216:SXu+4e/QsBTOuzDowZcXw0GzyGl02BE6F7qBQj9ZlhnO3NMhTAjrOSXy4BK:64wBTOETc8yM0QEc7qBQ//hSrOSX7
- TLSH T1B27712C355DDA6F8C0930634538223CB24D0B8EA96FDD71D3EC64C035967EAA298D7B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-18_30ff1bef4ed7de84455a170656695319_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260130-en
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-18_30ff1bef4ed7de84455a170656695319_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11-20260130-en
13 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-18_30ff1bef4ed7de84455a170656695319_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 32.4MB
- SHA256 d548b01c2304b07b4b6ff75fccd53a173cefaee0b4607e2ea7bd670ccbf7f95d
- MD5 30ff1bef4ed7de84455a170656695319
- SHA1 30189b375b86691a0bf55e7fee5acf312b7f6a04
- SHA512 e8e83470448bfd125afab7000887e8c8647a1953a1367eb344b2582426ca49d52a3bb3164c5a0af216d57a5d70b4829ad197ca4b137827b9d850b350c902a174
- SSDEEP 393216:SXu+4e/QsBTOuzDowZcXw0GzyGl02BE6F7qBQj9ZlhnO3NMhTAjrOSXy4BK:64wBTOETc8yM0QEc7qBQ//hSrOSX7
- TLSH T1B27712C355DDA6F8C0930634538223CB24D0B8EA96FDD71D3EC64C035967EAA298D7B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtSetInformationThreadHideFromDebugger