7413b2f65880876fb529f05e659990bb4f26ed60eb1f6e0ea7208bb67c24f842

General

Target
2026-05-06_27d6c33d17413e9bebd28ec107941642_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 1.3MB
Sample260506-2s8dksfx2k
SHA256 7413b2f65880876fb529f05e659990bb4f26ed60eb1f6e0ea7208bb67c24f842
MD5 27d6c33d17413e9bebd28ec107941642
SHA1 9f706f1e871e28f59ffe7a0fdf41f5f234ff30c2
SHA512 8f6ac374fe9f31b68272f1604f2c41e738805d44c6fed514d87747bd42a1df5bae3eb06440dbbc2195321184c9f42e6bb3b66db00cdfd7d39812e154141d5e36
SSDEEP 12288:dOm8Ji36zkkhWqClQ1BvJm9LNC88M26dQ409aK3y1x9yDY9ImLNl0ybyLY:dOmH6IdGBWC88MD2DQr950
TLSH
T12B55391B3534509EDABAC57486A70A0AE471F85C0BE6F0FF638CA9D2AA17CC5543DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-06_27d6c33d17413e9bebd28ec107941642_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 1.3MB
- SHA256 7413b2f65880876fb529f05e659990bb4f26ed60eb1f6e0ea7208bb67c24f842
- MD5 27d6c33d17413e9bebd28ec107941642
- SHA1 9f706f1e871e28f59ffe7a0fdf41f5f234ff30c2
- SHA512 8f6ac374fe9f31b68272f1604f2c41e738805d44c6fed514d87747bd42a1df5bae3eb06440dbbc2195321184c9f42e6bb3b66db00cdfd7d39812e154141d5e36
- SSDEEP 12288:dOm8Ji36zkkhWqClQ1BvJm9LNC88M26dQ409aK3y1x9yDY9ImLNl0ybyLY:dOmH6IdGBWC88MD2DQr950
- TLSH
  T12B55391B3534509EDABAC57486A70A0AE471F85C0BE6F0FF638CA9D2AA17CC5543DF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery spyware stealer
- Custom signature
  
  Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Custom signature
  
  Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Custom signature
  
  Detects executables Discord URL observed in first stage droppers
- Enumerates VirtualBox registry keys
  defense_evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Deletes itself
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2