ad5d03b0d9559d5504e8e18154255d5f929840d4f52ede853560aed98668f5dd

General

Target
2026-06-30_c0602b62787f9be10ad929a35f678c77_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample260701-dhb1mads2p
SHA256 ad5d03b0d9559d5504e8e18154255d5f929840d4f52ede853560aed98668f5dd
MD5 c0602b62787f9be10ad929a35f678c77
SHA1 0df64c759dcd357bd768e8210bd7e757d517ade9
SHA512 38e7379524db349048c35b4d2af30fdb2226eaeb8aa4a35db8056bcec51ef9a3db0216ab44939ac322673d260b597472f75091b5178e8066d0c43acfcd23b441
SSDEEP 6144:hsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRey2SvZbbzS:pH7F6cf6T7Ow5JRey2S
TLSH
T1D7947D16EA651179F3A79138CC574902E6B6FC4E07A99ADF03D0C9A22F276E09F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-06-30_c0602b62787f9be10ad929a35f678c77_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 ad5d03b0d9559d5504e8e18154255d5f929840d4f52ede853560aed98668f5dd
- MD5 c0602b62787f9be10ad929a35f678c77
- SHA1 0df64c759dcd357bd768e8210bd7e757d517ade9
- SHA512 38e7379524db349048c35b4d2af30fdb2226eaeb8aa4a35db8056bcec51ef9a3db0216ab44939ac322673d260b597472f75091b5178e8066d0c43acfcd23b441
- SSDEEP 6144:hsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRey2SvZbbzS:pH7F6cf6T7Ow5JRey2S
- TLSH
  T1D7947D16EA651179F3A79138CC574902E6B6FC4E07A99ADF03D0C9A22F276E09F3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2