877be28102469da1c805f27abcf7afb1670a2031b3c2168f89d1bd2c1037d910

General

Target
2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample260705-yteacaft9v
SHA256 877be28102469da1c805f27abcf7afb1670a2031b3c2168f89d1bd2c1037d910
MD5 175b8caba89cfe1d8da7f44a3b7acb3e
SHA1 b0996b945266c5a866421ac590860d46345db8ef
SHA512 9d78c2426a34ea1442c8c181546c2308bcaf4d86e927697e990bb0069d56a95f0029ae6829e9b58dbe9071a834b6bd1b3763545880a6048fd7df0cf52c5277d9
SSDEEP 6144:fsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRUIZGNzS:3H7F6cf6T7Ow5JRU
TLSH
T172945D16EAE510B9F1E7B638CC564902E6B6784E07A197CF03D0C9A62F376D09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-05_175b8caba89cfe1d8da7f44a3b7acb3e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 877be28102469da1c805f27abcf7afb1670a2031b3c2168f89d1bd2c1037d910
- MD5 175b8caba89cfe1d8da7f44a3b7acb3e
- SHA1 b0996b945266c5a866421ac590860d46345db8ef
- SHA512 9d78c2426a34ea1442c8c181546c2308bcaf4d86e927697e990bb0069d56a95f0029ae6829e9b58dbe9071a834b6bd1b3763545880a6048fd7df0cf52c5277d9
- SSDEEP 6144:fsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRUIZGNzS:3H7F6cf6T7Ow5JRU
- TLSH
  T172945D16EAE510B9F1E7B638CC564902E6B6784E07A197CF03D0C9A62F376D09B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution exploit persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2