General
- Target 2026-07-09_99b5975c299e83c82ba624c585d6a179_cobalt-strike_helldown_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar
- Size 710KB
- Sample260709-mfz44shv91
- SHA256 9a10ff36b67a9fd1fd4e33cd2cbf91b3ea9a50379b80fc13c9c87741a27cf053
- MD5 99b5975c299e83c82ba624c585d6a179
- SHA1 28bf6b13f7e3a902025ebde3cb8fda9385f1a905
- SHA512 61e34c5ff2027bcaaf1aa3a360e4d254c0b3bd29011240ec7ee55449aa01bcb7d9e603855ab8d05e439def489dbc08a20eb75d7a29abb1fd1748d027491500ee
- SSDEEP 12288:2nQmC/1NUQeBkK/GSvDMwgCfWlYAavfGzrAK61PTZhl:wQmC/rUQerGSvDMwgCfeofGzreTZhl
- TLSH T1F0F47C66ABE405FDC067C179C9574603F7B6B80A1360AACF07D54AA62F23BE55E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_99b5975c299e83c82ba624c585d6a179_cobalt-strike_helldown_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_99b5975c299e83c82ba624c585d6a179_cobalt-strike_helldown_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar.exe
Resource
win11ltsc2024-20260706-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_99b5975c299e83c82ba624c585d6a179_cobalt-strike_helldown_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar
- Size 710KB
- SHA256 9a10ff36b67a9fd1fd4e33cd2cbf91b3ea9a50379b80fc13c9c87741a27cf053
- MD5 99b5975c299e83c82ba624c585d6a179
- SHA1 28bf6b13f7e3a902025ebde3cb8fda9385f1a905
- SHA512 61e34c5ff2027bcaaf1aa3a360e4d254c0b3bd29011240ec7ee55449aa01bcb7d9e603855ab8d05e439def489dbc08a20eb75d7a29abb1fd1748d027491500ee
- SSDEEP 12288:2nQmC/1NUQeBkK/GSvDMwgCfWlYAavfGzrAK61PTZhl:wQmC/rUQerGSvDMwgCfeofGzreTZhl
- TLSH T1F0F47C66ABE405FDC067C179C9574603F7B6B80A1360AACF07D54AA62F23BE55E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Suspicious use of NtSetInformationThreadHideFromDebugger