827f0259fa1b2d12733483f36f4e43ffa12d0f5c0fd860ab71bb5b0e7a1f56e8

General

Target
2026-07-11_e0df3a4d4840ffb6cc435a7efef7902c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample260711-wpflhagt2r
SHA256 827f0259fa1b2d12733483f36f4e43ffa12d0f5c0fd860ab71bb5b0e7a1f56e8
MD5 e0df3a4d4840ffb6cc435a7efef7902c
SHA1 8df9b000e0bb27dd7baffa14df78fc42703b9efd
SHA512 47d30de91bdd3d6790cffee4fc45604b13d444c5a6c887e331de1dac329344f10fa0abe67dc10dc7de9141c1a45d9984315ad186eed71b911f6aa944301e36aa
SSDEEP 6144:7sO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRWLZHZzS:bH7F6cf6T7Ow5JR
TLSH
T16D946C16EA65007DF1ABA538CD565A02E6F5784E07A19ACF03D0CAB32F276D09F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-11_e0df3a4d4840ffb6cc435a7efef7902c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 827f0259fa1b2d12733483f36f4e43ffa12d0f5c0fd860ab71bb5b0e7a1f56e8
- MD5 e0df3a4d4840ffb6cc435a7efef7902c
- SHA1 8df9b000e0bb27dd7baffa14df78fc42703b9efd
- SHA512 47d30de91bdd3d6790cffee4fc45604b13d444c5a6c887e331de1dac329344f10fa0abe67dc10dc7de9141c1a45d9984315ad186eed71b911f6aa944301e36aa
- SSDEEP 6144:7sO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRWLZHZzS:bH7F6cf6T7Ow5JR
- TLSH
  T16D946C16EA65007DF1ABA538CD565A02E6F5784E07A19ACF03D0CAB32F276D09F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution exploit persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2