d362cf8065c4b1f76725a63b56c9f7adf28204f7acd0168942bf3b4a56f0c918

General

Target
2026-07-17_661fd9469260c1527125778b36c742e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample260717-mvtkwac14v
SHA256 d362cf8065c4b1f76725a63b56c9f7adf28204f7acd0168942bf3b4a56f0c918
MD5 661fd9469260c1527125778b36c742e5
SHA1 512f2e96a805d5e7fc327857b202dda4d264ba38
SHA512 9e9a61ab8fcf25e6d85c0c173b0fd1fa6f962ce7fc52cecf5bfb4242a23365117fcf6bd5bed6a7a3dbe789daee3d66014365a4dd08a3d3e20646e489143b5d8e
SSDEEP 6144:0sO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRoZt8zS:8H7F6cf6T7Ow5JR
TLSH
T118946D16EAA53079E1A7D1F8CC574902E6B57C8E07A19BCF03D449A22F2B6D09F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-17_661fd9469260c1527125778b36c742e5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 d362cf8065c4b1f76725a63b56c9f7adf28204f7acd0168942bf3b4a56f0c918
- MD5 661fd9469260c1527125778b36c742e5
- SHA1 512f2e96a805d5e7fc327857b202dda4d264ba38
- SHA512 9e9a61ab8fcf25e6d85c0c173b0fd1fa6f962ce7fc52cecf5bfb4242a23365117fcf6bd5bed6a7a3dbe789daee3d66014365a4dd08a3d3e20646e489143b5d8e
- SSDEEP 6144:0sO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRoZt8zS:8H7F6cf6T7Ow5JR
- TLSH
  T118946D16EAA53079E1A7D1F8CC574902E6B57C8E07A19BCF03D449A22F2B6D09F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

bootkit defense_evasion discovery execution exploit persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Executes dropped EXE
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2