d519c56ba7c50d838c5f25357c8620b77b32874f093e78eaed7efea6f6eba391

General

Target
2026-07-21_c379a415cf61ce40edcab1fbefd71442_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample260721-qe488awfrd
SHA256 d519c56ba7c50d838c5f25357c8620b77b32874f093e78eaed7efea6f6eba391
MD5 c379a415cf61ce40edcab1fbefd71442
SHA1 286b5e6dd1de2278ce24f685fe78f8b6ba37b30b
SHA512 44596db743fdf9299684a77019b5db0664b819964aeb8778b32e8446b8abf879e014f20ccf1992916bdfc07304edecf97c0d27d4c966dafaa73aadcbe5ad5c28
SSDEEP 6144:3sO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRtr4Zq9zS:/H7F6cf6T7Ow5JR
TLSH
T1E7947D16EA65217DE1B7D17CCC574A02E6B5784E07A1AACF03E049A22F276D2DF3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-21_c379a415cf61ce40edcab1fbefd71442_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 d519c56ba7c50d838c5f25357c8620b77b32874f093e78eaed7efea6f6eba391
- MD5 c379a415cf61ce40edcab1fbefd71442
- SHA1 286b5e6dd1de2278ce24f685fe78f8b6ba37b30b
- SHA512 44596db743fdf9299684a77019b5db0664b819964aeb8778b32e8446b8abf879e014f20ccf1992916bdfc07304edecf97c0d27d4c966dafaa73aadcbe5ad5c28
- SSDEEP 6144:3sO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRtr4Zq9zS:/H7F6cf6T7Ow5JR
- TLSH
  T1E7947D16EA65217DE1B7D17CCC574A02E6B5784E07A1AACF03E049A22F276D2DF3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution exploit persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2