Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 04:58
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-01_8e5a9c06b4b21c972825bee70ab69268_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_8e5a9c06b4b21c972825bee70ab69268_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-08-01_8e5a9c06b4b21c972825bee70ab69268_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
- Size 779KB
- Sample260801-fmcttswsaz
- SHA256 e4f4cc70eed17061b50efde80a3e07dbb3fb0e220166157644b450c720a847f5
- MD5 8e5a9c06b4b21c972825bee70ab69268
- SHA1 c8e09ba127e214086c101468cc2aba7a07c75a6c
- SHA512 7ca9772fb04a7138de4f81d0c071dd5f0da1094f16ac6de38cd9b0b5cb30d1c7a8f81b0b6ab58330ea2082279db2b52b4a1acbdee90d82e6e34f1e82649e280a
- SSDEEP 6144:Mk6z+vIk/+LDSGtqtq/LLI3U61HCMIfvBYLcYxAPi/bx/cgIh4gTOI6e/tMuQXnj:Qz5g+pfLrU3XgazuQXnpF9qVIWW7OS
- TLSH T156052A2A5B9402BCF0B7D27ACE959D52EB35740E03F2ADDF0B9044A65E671A04F3A713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 discord.com 10 discord.com 36 discord.com - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 8 api.ipify.org
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\rat_debug.txt
- Size 507B
- SHA256 75ee86e701cb868e4608ace1334066c9b15788463d121b52bf510d76150092ac
- MD5 5a1e1f572139c9eeb8e492de5607511e
- SHA1 c3ead045fced054a9fd2c6f7357127c54958ef50
- SHA512 5ba74088c40ed70765dff2897b4cf450e0a26d4c79f976dc10e621a3921ed877adba1f356ccf6b7af41115ac91c931f84929e686f2a02d74c9f59ad9b9703716
- TLSH T16CF0A0380565BC76C6B3D08DE553428EA4F0A4432F36C603967570A87F3ADC052343A5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\rat_debug.txt
- Size 165B
- SHA256 9af39c8fcfa2b437f4be466c53dacf56655fcfab8ef28fd540fd36040b807383
- MD5 0161839172de2d197d714f8601366b99
- SHA1 99ac758e07a5e5e45bdeb04eb785ce88a906fbcf
- SHA512 a78f571bb3f67e6998ebf2ebf42f802840c33ed6e3c6444913fe9b76f2facda9fc3a6ba60d708603c97e5140931b43a3164ae8b19f15367ca95b5e7ae4370cd8
- TLSH T131C0013C2558FC35CA33E08EF553028CA4F0E5277A308A46AA38718877B9DC22238640
- MD5 SHA1 SHA512 TLSH