1a9bb981fe27db056c81c0dd246c76342af992bade662d1237e7ed65c2b6c8b4

General

Target
2026-07-08_dd628b96fa592477b1932336e0e0adc1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample260708-3pt78abv2z
SHA256 1a9bb981fe27db056c81c0dd246c76342af992bade662d1237e7ed65c2b6c8b4
MD5 dd628b96fa592477b1932336e0e0adc1
SHA1 237fe8d24203aaa98f32e335c5efdba4a10ac6ac
SHA512 5dda4963c6e72e338315a3196abc29a10b99af64353eb4093d712020ff5a2dec7c2d4ed1e8b15113c2852446cef3dc905dd8adba6f80fa8a80769461ea51ce29
SSDEEP 6144:JsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GR0MlZsHzS:BH7F6cf6T7Ow5JR
TLSH
T192947E16EBA5307DE1A79338DC574902E6B57C5E03A19ACF03E049A22F276D0AF3D791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-08_dd628b96fa592477b1932336e0e0adc1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 1a9bb981fe27db056c81c0dd246c76342af992bade662d1237e7ed65c2b6c8b4
- MD5 dd628b96fa592477b1932336e0e0adc1
- SHA1 237fe8d24203aaa98f32e335c5efdba4a10ac6ac
- SHA512 5dda4963c6e72e338315a3196abc29a10b99af64353eb4093d712020ff5a2dec7c2d4ed1e8b15113c2852446cef3dc905dd8adba6f80fa8a80769461ea51ce29
- SSDEEP 6144:JsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GR0MlZsHzS:BH7F6cf6T7Ow5JR
- TLSH
  T192947E16EBA5307DE1A79338DC574902E6B57C5E03A19ACF03E049A22F276D0AF3D791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2