3516d96b61cd25623afa665a20665359de9fc0416727e4c18c37fd3bc6129579

General

Target
2026-07-08_f2cbb776d03b5cd94c76f4bacdbebb8f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample260708-lnpsnsdy8v
SHA256 3516d96b61cd25623afa665a20665359de9fc0416727e4c18c37fd3bc6129579
MD5 f2cbb776d03b5cd94c76f4bacdbebb8f
SHA1 1c4b107596aa731cfddb6cbaa0136a773c45abf4
SHA512 fe1b43b2ba5283a21c15755a31d3a56050a1236119719468b68d0a2a0c69cf4d914fcf3b047d12872d069ee826288f0477fd8b2db487215de2cd40420ab31ae7
SSDEEP 6144:HsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRCTKZPVzS:vH7F6cf6T7Ow5JR
TLSH
T148946D57EA690079F1A79178CC575B03E6B5B84E07E1AACF03E0C9A22F276D09B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-08_f2cbb776d03b5cd94c76f4bacdbebb8f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 3516d96b61cd25623afa665a20665359de9fc0416727e4c18c37fd3bc6129579
- MD5 f2cbb776d03b5cd94c76f4bacdbebb8f
- SHA1 1c4b107596aa731cfddb6cbaa0136a773c45abf4
- SHA512 fe1b43b2ba5283a21c15755a31d3a56050a1236119719468b68d0a2a0c69cf4d914fcf3b047d12872d069ee826288f0477fd8b2db487215de2cd40420ab31ae7
- SSDEEP 6144:HsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRCTKZPVzS:vH7F6cf6T7Ow5JR
- TLSH
  T148946D57EA690079F1A79178CC575B03E6B5B84E07E1AACF03E0C9A22F276D09B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery execution exploit persistence adware spyware
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2