General
- Target 2026-08-03_cd8929a01013b4ec33fb2b13116a6387_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 3.4MB
- Sample260803-cmcmaaz1by
- SHA256 4da7d9462550306f9f5a6203ccfbce8ec2123b0df32d3a454a646b0eca5f9a33
Score
10/10
Malware Config
Targets
-
- Target 2026-08-03_cd8929a01013b4ec33fb2b13116a6387_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 3.4MB
- SHA256 4da7d9462550306f9f5a6203ccfbce8ec2123b0df32d3a454a646b0eca5f9a33
Score10/10-
Modifies Windows Defender Real-time Protection settings
-
Modifies Windows Defender TamperProtection settings
-
Modifies Windows Defender notification settings
-
Modifies firewall policy service
-
Windows security bypass
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Boot or Logon Autostart Execution: LSASS Driver
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
-
Executes dropped EXE
-
Loads dropped DLL
-
Windows security modification
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2LSASS Driver
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Privilege Escalation
Boot or Logon Autostart Execution
2LSASS Driver
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4