General
- Target 2026-04-19_6bb84096dae499a1f17838f593c384b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 2.0MB
- Sample260419-tmpehsbx3w
- SHA256 386e12b4ea31f3384dfe2dd7f47f447177c0cb907650038ce2fe243fbdcdad2a
- MD5 6bb84096dae499a1f17838f593c384b3
- SHA1 2d90f6fb09cf24281512816756be256f7be6b27b
- SHA512 36a22f6e5cb1179908e1d16cf47aed5a4898fa87cfa3c38e186b5eb6414ebf4356602170de381ae8c8125bd2ef0f255e8f990798b2bb13ac19d8ff5060269ed7
- SSDEEP 49152:CePq5FBMKd4sKk+Ynyh/qNwffAj3g/bTqSk6jy:Cs/lgQ/6SU
- TLSH T144A5D00EF3A645ADE7A6B139C1645317E762782A533147EB73C40929AF8B2F04FB9341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-19_6bb84096dae499a1f17838f593c384b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260130-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-19_6bb84096dae499a1f17838f593c384b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11-20260130-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-19_6bb84096dae499a1f17838f593c384b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 2.0MB
- SHA256 386e12b4ea31f3384dfe2dd7f47f447177c0cb907650038ce2fe243fbdcdad2a
- MD5 6bb84096dae499a1f17838f593c384b3
- SHA1 2d90f6fb09cf24281512816756be256f7be6b27b
- SHA512 36a22f6e5cb1179908e1d16cf47aed5a4898fa87cfa3c38e186b5eb6414ebf4356602170de381ae8c8125bd2ef0f255e8f990798b2bb13ac19d8ff5060269ed7
- SSDEEP 49152:CePq5FBMKd4sKk+Ynyh/qNwffAj3g/bTqSk6jy:Cs/lgQ/6SU
- TLSH T144A5D00EF3A645ADE7A6B139C1645317E762782A533147EB73C40929AF8B2F04FB9341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.