General
- Target 2026-06-28_28a09849ee2ac1189173dcebe38ed870_cobalt-strike_icedid_njrat
- Size 759KB
- Sample260628-3rdm9agx7s
- SHA256 f2bd73673ce1df575fe2814aa904d0766427db683a90c8808b167dbfd644d850
Score
10/10
Malware Config
Targets
-
- Target 2026-06-28_28a09849ee2ac1189173dcebe38ed870_cobalt-strike_icedid_njrat
- Size 759KB
- SHA256 f2bd73673ce1df575fe2814aa904d0766427db683a90c8808b167dbfd644d850
Score9/10-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
-
Detects command variations typically used by ransomware
-
Detects executables embedding command execution via IExecuteCommand COM object
-
Detects ransomware indicator
-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Looks for Xen service registry key.