General
- Target 2026-04-19_9eeb5ddf4f002ac7b032f0b77a8fe226_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 7.2MB
- Sample260420-aceyjsdx2n
- SHA256 5ed33080612d8324c4292f3483ebec6a5a97a385369998ed4e7205500d51629a
- MD5 9eeb5ddf4f002ac7b032f0b77a8fe226
- SHA1 b7998e87b8421cdcadb53ac8b472462ab9255d8f
- SHA512 83e6e18df4f935bcddb460759f5cab1147d3c79ca790d1aab036e7b7891d8147e469fcbdebaf42fd29ad39657074327f1eee7338b7511d7fbb8793df0e47eb03
- SSDEEP 49152:pVdbcZiQ59a3EbEMUn6RVR4SME9ca+35SEGHy+/o+wiofnxaPKq5wMJn7q4TUEkh:pk2+Uns+mFOfnxiKE1TO8TIzVRJIB4TF
- TLSH T12276BF16A3E901ACF0F7C675CA265913E9727CD91732E6DF069065192F33AA08F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-04-19_9eeb5ddf4f002ac7b032f0b77a8fe226_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260130-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-19_9eeb5ddf4f002ac7b032f0b77a8fe226_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11-20260130-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-04-19_9eeb5ddf4f002ac7b032f0b77a8fe226_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 7.2MB
- SHA256 5ed33080612d8324c4292f3483ebec6a5a97a385369998ed4e7205500d51629a
- MD5 9eeb5ddf4f002ac7b032f0b77a8fe226
- SHA1 b7998e87b8421cdcadb53ac8b472462ab9255d8f
- SHA512 83e6e18df4f935bcddb460759f5cab1147d3c79ca790d1aab036e7b7891d8147e469fcbdebaf42fd29ad39657074327f1eee7338b7511d7fbb8793df0e47eb03
- SSDEEP 49152:pVdbcZiQ59a3EbEMUn6RVR4SME9ca+35SEGHy+/o+wiofnxaPKq5wMJn7q4TUEkh:pk2+Uns+mFOfnxiKE1TO8TIzVRJIB4TF
- TLSH T12276BF16A3E901ACF0F7C675CA265913E9727CD91732E6DF069065192F33AA08F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE