ff12083cd3a63bd8a47d6c3c9cd53d54bc09b519fb83775209523ce92062eab1

General

Target
2026-07-20_1e8d7dfd05fd22623f3b941f3aba3683_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample260720-dzx97ady9l
SHA256 ff12083cd3a63bd8a47d6c3c9cd53d54bc09b519fb83775209523ce92062eab1
MD5 1e8d7dfd05fd22623f3b941f3aba3683
SHA1 5a87d80684d66cae84b61ba167fb7585c2ba6382
SHA512 2130a6a7faf73008460f2f08a933c43d39b0324e93400036875681765ca6338b9037a1a69b352c035a0c24797b230cdea49383a470b3aae7516ec0b263025f9f
SSDEEP 6144:/sO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRKZD9zS:XH7F6cf6T7Ow5JR
TLSH
T1E5946D16EAA500BDF1A7D178CC574902E6B5785E07A19ACF03E0CBA62F276D09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-20_1e8d7dfd05fd22623f3b941f3aba3683_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 ff12083cd3a63bd8a47d6c3c9cd53d54bc09b519fb83775209523ce92062eab1
- MD5 1e8d7dfd05fd22623f3b941f3aba3683
- SHA1 5a87d80684d66cae84b61ba167fb7585c2ba6382
- SHA512 2130a6a7faf73008460f2f08a933c43d39b0324e93400036875681765ca6338b9037a1a69b352c035a0c24797b230cdea49383a470b3aae7516ec0b263025f9f
- SSDEEP 6144:/sO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRKZD9zS:XH7F6cf6T7Ow5JR
- TLSH
  T1E5946D16EAA500BDF1A7D178CC574902E6B5785E07A19ACF03E0CBA62F276D09B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution exploit persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2