General
- Target 2026-06-30_ce7f9a90e9ea79da6fd3c681eaff5a79_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
- Size 161KB
- Sample260630-w4babsfv2v
- SHA256 af59eaefd25729ff80c508d50d2e53b4c10611cf452bfa540d8fbbb24cb146b7
- MD5 ce7f9a90e9ea79da6fd3c681eaff5a79
- SHA1 5bb57f392f6f9c2f319637797f0fe88c6ed1caa1
- SHA512 c5a25bac01c7b2eaa34f76a2d215db52340c9a77d379e3daedd27c8971942dfb2438b8c5d12e89360a79fb541f0e6d3130633da50b1c8d2872993dbc63affabd
- SSDEEP 3072:iZXs4zrJMb6M8JRqNXvBscnOxO9cF4TyIPCOCs:aciJMmNAhlryIPu
- TLSH T1FAF37D5B73A530F9E1B78278C9911A46E772783107209BDF03A487762F236D19E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_ce7f9a90e9ea79da6fd3c681eaff5a79_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_ce7f9a90e9ea79da6fd3c681eaff5a79_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260629-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-30_ce7f9a90e9ea79da6fd3c681eaff5a79_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
- Size 161KB
- SHA256 af59eaefd25729ff80c508d50d2e53b4c10611cf452bfa540d8fbbb24cb146b7
- MD5 ce7f9a90e9ea79da6fd3c681eaff5a79
- SHA1 5bb57f392f6f9c2f319637797f0fe88c6ed1caa1
- SHA512 c5a25bac01c7b2eaa34f76a2d215db52340c9a77d379e3daedd27c8971942dfb2438b8c5d12e89360a79fb541f0e6d3130633da50b1c8d2872993dbc63affabd
- SSDEEP 3072:iZXs4zrJMb6M8JRqNXvBscnOxO9cF4TyIPCOCs:aciJMmNAhlryIPu
- TLSH T1FAF37D5B73A530F9E1B78278C9911A46E772783107209BDF03A487762F236D19E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.