6d269639e860a57cca48b13a5c75e453a073bab348a7a9ef9135e282578cb556

General

Target
2026-07-29_952a822118af499e1a778640116a9472_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample260729-pe2mnafp4y
SHA256 6d269639e860a57cca48b13a5c75e453a073bab348a7a9ef9135e282578cb556
MD5 952a822118af499e1a778640116a9472
SHA1 43fb6c5246e4e4078d566d67e547d3ff9d6a45ef
SHA512 49506efcf046f9083403efd65f967842b902676bd37bec66d142966b51e08f8cc5a5e414a1469c5e492911c2d0fdef3d3ec59f26d1301b980330b37bace6ce7f
SSDEEP 6144:gsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRvbYZOwzS:QH7F6cf6T7Ow5JRvb
TLSH
T197948E16EA6C207DF1A7A138CC574902E6B57C4D83A99ACF1BD049A22F276D09F3D713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-07-29_952a822118af499e1a778640116a9472_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 6d269639e860a57cca48b13a5c75e453a073bab348a7a9ef9135e282578cb556
- MD5 952a822118af499e1a778640116a9472
- SHA1 43fb6c5246e4e4078d566d67e547d3ff9d6a45ef
- SHA512 49506efcf046f9083403efd65f967842b902676bd37bec66d142966b51e08f8cc5a5e414a1469c5e492911c2d0fdef3d3ec59f26d1301b980330b37bace6ce7f
- SSDEEP 6144:gsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRvbYZOwzS:QH7F6cf6T7Ow5JRvb
- TLSH
  T197948E16EA6C207DF1A7A138CC574902E6B57C4D83A99ACF1BD049A22F276D09F3D713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution exploit persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2