e827d48d4862ff034ee299d8b55afeab7ff85cc5aad5320ac1ad7daeba04a9fe

General

Target
2026-05-23_d3af62ebf39112a0ad1c4e57dfeddfed_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample260523-3dp45afs71
SHA256 e827d48d4862ff034ee299d8b55afeab7ff85cc5aad5320ac1ad7daeba04a9fe
MD5 d3af62ebf39112a0ad1c4e57dfeddfed
SHA1 f9c2315c6ec8ad8cb4a4ee71c2235f9ba3099732
SHA512 6f3565391de4eb663f0fad8f73c38c13db56dc7579735c57ca0d5a7eb75c6eb1a4d1328b771fad3d7232196634b36c1770bf093530c3c1974a3940708a59c86b
SSDEEP 6144:vsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GR5g3kZUdzS:nH7F6cf6T7Ow5JR
TLSH
T18E946D26EAE5007DF1A7F138CC664902E6B5BC4E07A196CF03D0D9A72F276D09A7D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-05-23_d3af62ebf39112a0ad1c4e57dfeddfed_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 e827d48d4862ff034ee299d8b55afeab7ff85cc5aad5320ac1ad7daeba04a9fe
- MD5 d3af62ebf39112a0ad1c4e57dfeddfed
- SHA1 f9c2315c6ec8ad8cb4a4ee71c2235f9ba3099732
- SHA512 6f3565391de4eb663f0fad8f73c38c13db56dc7579735c57ca0d5a7eb75c6eb1a4d1328b771fad3d7232196634b36c1770bf093530c3c1974a3940708a59c86b
- SSDEEP 6144:vsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GR5g3kZUdzS:nH7F6cf6T7Ow5JR
- TLSH
  T18E946D26EAE5007DF1A7F138CC664902E6B5BC4E07A196CF03D0D9A72F276D09A7D711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution exploit persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2