General
- Target 2026-07-20_5aadfd17ac16bb920e8dd8e71d5cf70d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 4.0MB
- Sample260720-nxsl2abs5s
- SHA256 4ea0b12899dc49ce1ddea55310b94de5abda6502672936af6aa22748e46f78c5
- MD5 5aadfd17ac16bb920e8dd8e71d5cf70d
- SHA1 cc17c84b797c88af5752c5b9fe646d7025420f8f
- SHA512 f9d1f5b68d083f5c0e138b6fe128a94c2bb4b0f887716d28ca038b5f3fedc9bedb0c3381714522c4cce779c8739f6b0e90520117801ef16cb7bd4ff2ea5b6a72
- SSDEEP 49152:8vew15R0+l5xDxl/8blvq+MAep53lUm1t1bAotc4Wu3rPOhQT0RcRjoxnMkgYh6:k/rbASfoxnMkgYo
- TLSH T1C1167C07E7B901E9C4BBD13D8A569657FAB27849877197CB07A0835A4F237E09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_5aadfd17ac16bb920e8dd8e71d5cf70d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_5aadfd17ac16bb920e8dd8e71d5cf70d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 4.0MB
- SHA256 4ea0b12899dc49ce1ddea55310b94de5abda6502672936af6aa22748e46f78c5
- MD5 5aadfd17ac16bb920e8dd8e71d5cf70d
- SHA1 cc17c84b797c88af5752c5b9fe646d7025420f8f
- SHA512 f9d1f5b68d083f5c0e138b6fe128a94c2bb4b0f887716d28ca038b5f3fedc9bedb0c3381714522c4cce779c8739f6b0e90520117801ef16cb7bd4ff2ea5b6a72
- SSDEEP 49152:8vew15R0+l5xDxl/8blvq+MAep53lUm1t1bAotc4Wu3rPOhQT0RcRjoxnMkgYh6:k/rbASfoxnMkgYo
- TLSH T1C1167C07E7B901E9C4BBD13D8A569657FAB27849877197CB07A0835A4F237E09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1