8196636f71f295273e8e81c889c402e6317dd816bb4fd539468630d7e74b3645 | Triage™

Login
Reports

Overview

overview

Static

static

2026-05-03...om.exe

windows10-2004-x64

9

2026-05-03...om.exe

windows11-21h2-x64

9

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-03_ec0cbf29dfc3c08157a1a0d7349aae95_cobalt-strike_icedid_luca-stealer_njrat_satacom
Size 158KB
Sample260504-aecafaat6w
SHA256 8196636f71f295273e8e81c889c402e6317dd816bb4fd539468630d7e74b3645
MD5 ec0cbf29dfc3c08157a1a0d7349aae95
SHA1 ccbd93e204d5eed43c480bd41e4b61d9783451f2
SHA512 36fa3ff36fcf366bcd25d1ecfc8b7c97c309dc9e8f4860771b4e1bf32158b78487665d898ad5e3663e66abe1257b6bb2c72f733277b854c4496a373a8e893292
SSDEEP 3072:Z5SMc2r/psz7Nke0Km3k2w92Xt+dA960P5pq3C2eA/0Cwaed:qC/23I0792fCwzd
TLSH
T165F35B5777A530FAE0739239C9610A46E7737C3207609BEF03A457766E232D1AD3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

2026-05-03_ec0cbf29dfc3c08157a1a0d7349aae95_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe

Resource

win10v2004-20260130-en

windows10-2004-x64

7 signatures

150 seconds

defense_evasion

Behavioral task

behavioral2

Sample

2026-05-03_ec0cbf29dfc3c08157a1a0d7349aae95_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe

Resource

win11-20260130-en

windows11-21h2-x64

7 signatures

150 seconds

defense_evasion

Malware Config

Targets

- Target
  2026-05-03_ec0cbf29dfc3c08157a1a0d7349aae95_cobalt-strike_icedid_luca-stealer_njrat_satacom
- Size 158KB
- SHA256 8196636f71f295273e8e81c889c402e6317dd816bb4fd539468630d7e74b3645
- MD5 ec0cbf29dfc3c08157a1a0d7349aae95
- SHA1 ccbd93e204d5eed43c480bd41e4b61d9783451f2
- SHA512 36fa3ff36fcf366bcd25d1ecfc8b7c97c309dc9e8f4860771b4e1bf32158b78487665d898ad5e3663e66abe1257b6bb2c72f733277b854c4496a373a8e893292
- SSDEEP 3072:Z5SMc2r/psz7Nke0Km3k2w92Xt+dA960P5pq3C2eA/0Cwaed:qC/23I0792fCwzd
- TLSH
  T165F35B5777A530FAE0739239C9610A46E7737C3207609BEF03A457766E232D1AD3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasion

behavioral2

defense_evasion

© 2018-2026

Terms | Privacy