853b552fd3f748f0cc84d92f52c3a823874782ebe58226a808a420f33e0a68be

General

Target
2026-07-03_82b22c6ce31b50b14a78ff92ea2b006c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample260703-1mt4bsgx2w
SHA256 853b552fd3f748f0cc84d92f52c3a823874782ebe58226a808a420f33e0a68be
MD5 82b22c6ce31b50b14a78ff92ea2b006c
SHA1 80f84023e7e02118a00c0fb125ace26b6d008e68
SHA512 db0c24f1a03edec3c40c8fa268dc712c63b2e86a2809f8b9af18593cd8e5004f3ef8ff9299bb6a0461c06cf192ea58ee496413d0063c1dc6a8ee1176f4b1f8e2
SSDEEP 6144:PsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRuWZyNzS:HH7F6cf6T7Ow5JRu
TLSH
T17A947E96EA650079F1A7D138CC574902F6B5FC8D07A1AACF13D8C9A22F276D0AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-03_82b22c6ce31b50b14a78ff92ea2b006c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 853b552fd3f748f0cc84d92f52c3a823874782ebe58226a808a420f33e0a68be
- MD5 82b22c6ce31b50b14a78ff92ea2b006c
- SHA1 80f84023e7e02118a00c0fb125ace26b6d008e68
- SHA512 db0c24f1a03edec3c40c8fa268dc712c63b2e86a2809f8b9af18593cd8e5004f3ef8ff9299bb6a0461c06cf192ea58ee496413d0063c1dc6a8ee1176f4b1f8e2
- SSDEEP 6144:PsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRuWZyNzS:HH7F6cf6T7Ow5JRu
- TLSH
  T17A947E96EA650079F1A7D138CC574902F6B5FC8D07A1AACF13D8C9A22F276D0AB3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution exploit persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2