General
- Target 2026-07-09_6f21525ce0cd020607a76476db8eca40_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 4.0MB
- Sample260709-r5qdesc16w
- SHA256 3f0af04b5b5fa6a1e67cad9dae375d21bdadfc1e36f537b181adab63b4d2a663
- MD5 6f21525ce0cd020607a76476db8eca40
- SHA1 c1965fe412c5723852c9b8b23b61f8d5733b86d8
- SHA512 c86160637a68d23a7bb18a62e391a1be6d34d28b3f94927e92d62e0721fa2bd7ac83b78ee8b3309639dabfa521072c23467a2e7bb138e184cc30dc83211d1423
- SSDEEP 49152:ovWR16PVSW1BCe4l1jODsgF3fxo3PAbOGHE8d0FVBcuf68IASpzTTGRkebcFvVaj:Y/kY7EtFPLRJbAvVa3w6QA0dMJz6
- TLSH T1F9167B17E7B940F5C0BAD13D8A569657FAB2784A873197CB43A0875A1F237E09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_6f21525ce0cd020607a76476db8eca40_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-09_6f21525ce0cd020607a76476db8eca40_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 4.0MB
- SHA256 3f0af04b5b5fa6a1e67cad9dae375d21bdadfc1e36f537b181adab63b4d2a663
- MD5 6f21525ce0cd020607a76476db8eca40
- SHA1 c1965fe412c5723852c9b8b23b61f8d5733b86d8
- SHA512 c86160637a68d23a7bb18a62e391a1be6d34d28b3f94927e92d62e0721fa2bd7ac83b78ee8b3309639dabfa521072c23467a2e7bb138e184cc30dc83211d1423
- SSDEEP 49152:ovWR16PVSW1BCe4l1jODsgF3fxo3PAbOGHE8d0FVBcuf68IASpzTTGRkebcFvVaj:Y/kY7EtFPLRJbAvVa3w6QA0dMJz6
- TLSH T1F9167B17E7B940F5C0BAD13D8A569657FAB2784A873197CB43A0875A1F237E09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1