98cf755ce267114ea36e0b83df6c2c5ced83dd6abeb96d7b053b95c3fadeb6ac

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 22:44

Target
2026-05-27_0b549260543a5558a3794dbc13ed4f66_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 634KB
Sample260527-2pacdaax9m
SHA256 98cf755ce267114ea36e0b83df6c2c5ced83dd6abeb96d7b053b95c3fadeb6ac
MD5 0b549260543a5558a3794dbc13ed4f66
SHA1 5e1089b116ce8dd296d1a22f1c19737ed8bd81c0
SHA512 a167ea0e5df7379f49141882e2c953b9707343e2c1f252da63bb929dc827725aaf2f53532d6d143e11f69b19a7419d9290738dce66bd5d6f5acfffaa45986641
SSDEEP 12288:K4Qq5i8XZPzOpxcmWOdamqUuR7bKyveNs0gB1Zdlf:K4HXApxPWOdIGNsH1zlf
TLSH
T186D45B95E6A213F8C57AC334C559B01EF7F13E198334A2876786AB135F226989F3DB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	2026-05-27_0b549260543a5558a3794dbc13ed4f66_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-27_0b549260543a5558a3794dbc13ed4f66_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_0b549260543a5558a3794dbc13ed4f66_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
PID:4444

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact