73fd82e0ccf2b64cf4163e4dbf01e9d00faf96093f78a5dbe5589ac16e4c0b63

General

Target
2026-07-02_d4acd48ff5c326059e5c1fde788573a5_cobalt-strike_icedid_satacom_stealc
Size 5.9MB
Sample260702-2d8qssfx7z
SHA256 73fd82e0ccf2b64cf4163e4dbf01e9d00faf96093f78a5dbe5589ac16e4c0b63
MD5 d4acd48ff5c326059e5c1fde788573a5
SHA1 bc646462c539fcadb984502c4905a9efd472cf8f
SHA512 a9ecc7b02ff385f5dce587bc7f6897272b8283f9809eda8a81703f6af1d3e51c19d72bb99fb1752f1eac0704129bf6811954dc6394c657f877e316883865675a
SSDEEP 49152:AiU1moGJTcuN4ket4S5Tav1Xfu6NpYOn6w1zdAunxMiVkoUijGfD7vBguXdFIA:mDFtafu6NGOn6UJnMiVeijGL6SdFIA
TLSH
T1D8564DE725D2A6EEC01AD17E8383FD3F964F743E0D1AA4A3915462598E36C00BF95F09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-02_d4acd48ff5c326059e5c1fde788573a5_cobalt-strike_icedid_satacom_stealc
- Size 5.9MB
- SHA256 73fd82e0ccf2b64cf4163e4dbf01e9d00faf96093f78a5dbe5589ac16e4c0b63
- MD5 d4acd48ff5c326059e5c1fde788573a5
- SHA1 bc646462c539fcadb984502c4905a9efd472cf8f
- SHA512 a9ecc7b02ff385f5dce587bc7f6897272b8283f9809eda8a81703f6af1d3e51c19d72bb99fb1752f1eac0704129bf6811954dc6394c657f877e316883865675a
- SSDEEP 49152:AiU1moGJTcuN4ket4S5Tav1Xfu6NpYOn6w1zdAunxMiVkoUijGfD7vBguXdFIA:mDFtafu6NGOn6UJnMiVeijGL6SdFIA
- TLSH
  T1D8564DE725D2A6EEC01AD17E8383FD3F964F743E0D1AA4A3915462598E36C00BF95F09
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery spyware stealer themida trojan
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables packed with Themida
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2