General
- Target 2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 4.4MB
- Sample260723-jprmjsfr71
- SHA256 c7d450a627f8548889e4c5e1f2c5e1df98da35a9b57ef2d31f7af8160ceb5274
- MD5 5d8868306df8946be651f4a66bb007db
- SHA1 ac353980461c70753239b7141a2d3a8a31205dda
- SHA512 9cdd5934541388e1576e0302645d0d0cbeb2de70aab79f4a151d1036a6ba40d789b319446ae2e75ce1f98f4385f39448c0167da6d477df52272ed566cf9a929d
- SSDEEP 49152:TieKCyPTDmPCOXVU7rtmcLLp94Mv+lklxcmfiNMjO8YT6EsaB0zj0yjoB2:1OhlB6wEjB2Yyjl
- TLSH T1FE266A1BE2B940E5C0B7E1798A979557FAB27819873297DB4790470A1F23BF09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
17 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-23_5d8868306df8946be651f4a66bb007db_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 4.4MB
- SHA256 c7d450a627f8548889e4c5e1f2c5e1df98da35a9b57ef2d31f7af8160ceb5274
- MD5 5d8868306df8946be651f4a66bb007db
- SHA1 ac353980461c70753239b7141a2d3a8a31205dda
- SHA512 9cdd5934541388e1576e0302645d0d0cbeb2de70aab79f4a151d1036a6ba40d789b319446ae2e75ce1f98f4385f39448c0167da6d477df52272ed566cf9a929d
- SSDEEP 49152:TieKCyPTDmPCOXVU7rtmcLLp94Mv+lklxcmfiNMjO8YT6EsaB0zj0yjoB2:1OhlB6wEjB2Yyjl
- TLSH T1FE266A1BE2B940E5C0B7E1798A979557FAB27819873297DB4790470A1F23BF09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1