General
- Target 2026-07-20_fadd6b5e6d700d2bb6c2f669d6f8b6c6_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca-stealer_njrat_satacom_vidar
- Size 27.5MB
- Sample260720-ctckvse13x
- SHA256 ecfac04621be8038a9ff069da8cf2b480780912d52cafb15816706448675678c
Score
9/10
Malware Config
Targets
-
- Target 2026-07-20_fadd6b5e6d700d2bb6c2f669d6f8b6c6_amadey_cobalt-strike_hellokitty_hijackloader_icedid_luca-stealer_njrat_satacom_vidar
- Size 27.5MB
- SHA256 ecfac04621be8038a9ff069da8cf2b480780912d52cafb15816706448675678c
Score9/10-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1