Overview

overview

9

Static

static

3

2026-06-02...ar.exe

windows10-2004-x64

9

2026-06-02...ar.exe

windows11-21h2-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-06-02_cf5e5e04acc355366270d5d054ac4aed_cobalt-strike_elex_icedid_luca-stealer_njrat_satacom_stealc_vidar
  • Size 724KB
  • Sample260602-dzd7bacy7v
  • SHA256 f40263a7c787f3a4c997bad18c4e81548ae87303a95048ea301d35478961f524
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
credential_accessdiscoveryransomwarestealer

Malware Config

Targets

    • Target
      2026-06-02_cf5e5e04acc355366270d5d054ac4aed_cobalt-strike_elex_icedid_luca-stealer_njrat_satacom_stealc_vidar
    • Size 724KB
    • SHA256 f40263a7c787f3a4c997bad18c4e81548ae87303a95048ea301d35478961f524
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    credential_accessdiscoveryransomwarestealer

    • Renames multiple (18520) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks