General
- Target 2026-07-28_f0a2ddb301c6ab4247f8db6fcae80f16_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 14.2MB
- Sample260728-yf2hqabe54
- SHA256 9dda3f5c2db38d70c2df05224ddebf8d7ba3f10509fd20665ba304313f5e3d01
- MD5 f0a2ddb301c6ab4247f8db6fcae80f16
- SHA1 261737ac8565503f95eacb9339aed282c8331574
- SHA512 0d95bcb5157acf092035b53e314012ca3d65a502e01b3f73ce6e67d980e839f5556bcc269c8b11b0424b6a16eba7ab9dea8d2c48398bfff64aaf11f97deea049
- SSDEEP 196608:A0AAi8658M7/H7RMUsgFs7HW7tfGN/1X9/3mKGBvRXfibU8t1z6ZC5sdHuO2nNqb:yxfOi1TV7Iz9PsvF6Yqh6s5sbEOn9MTw
- TLSH T175E63369FFADCD80F1F5E8FC6A167A40D96F784603B9D52BC175192646AFB022D0A303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_f0a2ddb301c6ab4247f8db6fcae80f16_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_f0a2ddb301c6ab4247f8db6fcae80f16_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-28_f0a2ddb301c6ab4247f8db6fcae80f16_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 14.2MB
- SHA256 9dda3f5c2db38d70c2df05224ddebf8d7ba3f10509fd20665ba304313f5e3d01
- MD5 f0a2ddb301c6ab4247f8db6fcae80f16
- SHA1 261737ac8565503f95eacb9339aed282c8331574
- SHA512 0d95bcb5157acf092035b53e314012ca3d65a502e01b3f73ce6e67d980e839f5556bcc269c8b11b0424b6a16eba7ab9dea8d2c48398bfff64aaf11f97deea049
- SSDEEP 196608:A0AAi8658M7/H7RMUsgFs7HW7tfGN/1X9/3mKGBvRXfibU8t1z6ZC5sdHuO2nNqb:yxfOi1TV7Iz9PsvF6Yqh6s5sbEOn9MTw
- TLSH T175E63369FFADCD80F1F5E8FC6A167A40D96F784603B9D52BC175192646AFB022D0A303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables referencing many IR and analysis tools
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Executes a VBScript file via the Windows Script Host.