b0b13059a912d087feb7200a882305b1a93d9211b0c7edc3d3a5f6eea7868580 | Triage™

Login
Reports

Overview

overview

Static

static

2026-07-31...at.exe

windows10-2004-x64

9

2026-07-31...at.exe

windows11-ltsc_2024-x64

9

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_c94b3e7821fa8f5d7043fac96f17f812_cobalt-strike_icedid_luca-stealer_njrat
Size 394KB
Sample260731-c18a4st1cs
SHA256 b0b13059a912d087feb7200a882305b1a93d9211b0c7edc3d3a5f6eea7868580
MD5 c94b3e7821fa8f5d7043fac96f17f812
SHA1 acd9b363b079eadb7eedd68b9e0af2b89ca29f1e
SHA512 9e59ebadf9634f91e90fe0d43a11529d9b698c545d6ccc1f7cd67b85c9c34c5ad5dd498cb3cb044f11cf464bcf1748b0f690d56e5c4a70ebfef4b32be0ab5b8c
SSDEEP 6144:IIPo1sHwAMgvdPJacrm9GcehUSbOs1xYDBTpzpA+yISy4gy3:sgdPJ5r0GcO3bOsz4zpAMZE
TLSH
T17F848C56F3A500F9D1B7D138C9934906E772F8864760AACF03905AA61F376E0BE3E752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

2026-07-31_c94b3e7821fa8f5d7043fac96f17f812_cobalt-strike_icedid_luca-stealer_njrat.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

12 signatures

150 seconds

defense_evasion execution

Behavioral task

behavioral2

Sample

2026-07-31_c94b3e7821fa8f5d7043fac96f17f812_cobalt-strike_icedid_luca-stealer_njrat.exe

Resource

win11ltsc2024-20260710-en

windows11-ltsc_2024-x64

12 signatures

150 seconds

defense_evasion execution

Malware Config

Targets

- Target
  2026-07-31_c94b3e7821fa8f5d7043fac96f17f812_cobalt-strike_icedid_luca-stealer_njrat
- Size 394KB
- SHA256 b0b13059a912d087feb7200a882305b1a93d9211b0c7edc3d3a5f6eea7868580
- MD5 c94b3e7821fa8f5d7043fac96f17f812
- SHA1 acd9b363b079eadb7eedd68b9e0af2b89ca29f1e
- SHA512 9e59ebadf9634f91e90fe0d43a11529d9b698c545d6ccc1f7cd67b85c9c34c5ad5dd498cb3cb044f11cf464bcf1748b0f690d56e5c4a70ebfef4b32be0ab5b8c
- SSDEEP 6144:IIPo1sHwAMgvdPJacrm9GcehUSbOs1xYDBTpzpA+yISy4gy3:sgdPJ5r0GcO3bOsz4zpAMZE
- TLSH
  T17F848C56F3A500F9D1B7D138C9934906E772F8864760AACF03905AA61F376E0BE3E752
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion execution
- Detects executables referencing combination of virtualization drivers
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Stops running service(s)
  defense_evasion execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

defense_evasionexecution

behavioral2

defense_evasionexecution

© 2018-2026

Terms | Privacy