4154052c7990be454a685d63de9b973ce1339b57e813659c043a6da7675fe899

General

Target
2026-07-11_6e068b014fb891ed1855b00dd4f0a531_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample260711-ykcedscs4y
SHA256 4154052c7990be454a685d63de9b973ce1339b57e813659c043a6da7675fe899
MD5 6e068b014fb891ed1855b00dd4f0a531
SHA1 dd3d0c63a91ff41fb0c9d4589991c39e7a64e45f
SHA512 67d5e3476ef1928727c1b12af6d6486029e8d53f0127f00837324e580542729f540904406367a5a1bfef14f6ecdd428640922152bc1c051e9732a9e38d534315
SSDEEP 6144:rsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRLZGpzS:rH7F6cf6T7Ow5JR
TLSH
T123948D16EA680079F3A7953CCC575902E6B5B94E07A19ACF0BE0C9A32F276D09F3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-11_6e068b014fb891ed1855b00dd4f0a531_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 4154052c7990be454a685d63de9b973ce1339b57e813659c043a6da7675fe899
- MD5 6e068b014fb891ed1855b00dd4f0a531
- SHA1 dd3d0c63a91ff41fb0c9d4589991c39e7a64e45f
- SHA512 67d5e3476ef1928727c1b12af6d6486029e8d53f0127f00837324e580542729f540904406367a5a1bfef14f6ecdd428640922152bc1c051e9732a9e38d534315
- SSDEEP 6144:rsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRLZGpzS:rH7F6cf6T7Ow5JR
- TLSH
  T123948D16EA680079F3A7953CCC575902E6B5B94E07A19ACF0BE0C9A32F276D09F3D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution exploit persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2