bf671700b70f29e80c2271b55e66c12809232abe9c56d4a467caa60d50f77db1

General

Target
2026-08-04_2ff14f12a5acd58e756cfec9d4730efa_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 479KB
Sample260804-jpw72aam3v
SHA256 bf671700b70f29e80c2271b55e66c12809232abe9c56d4a467caa60d50f77db1
MD5 2ff14f12a5acd58e756cfec9d4730efa
SHA1 ff4f6f2395070ee9aac3ae891613c1a8edcd94e8
SHA512 bf75956fc9a5e60ff25a2f86889f30d564eb7bcfed4681325dbce39fbf12a490ef98712d4ebca7a2191a347061542689930e594abfcfbfe267f70d30403ba6a2
SSDEEP 6144:S1QgrTZu458LqcWAv3R7TNrqZlDvtN2VeQ571GUBzesJJCnYrItZspXJOfQXvtE/:4X8PWAv3Kztq/RtewVEzsufQXvtk
TLSH
T13AA45E19A69802F9E1B7C179CAD64C06F772780A0770EEDF03948A765F276D04E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-04_2ff14f12a5acd58e756cfec9d4730efa_cobalt-strike_icedid_luca-stealer_njrat_stealc
- Size 479KB
- SHA256 bf671700b70f29e80c2271b55e66c12809232abe9c56d4a467caa60d50f77db1
- MD5 2ff14f12a5acd58e756cfec9d4730efa
- SHA1 ff4f6f2395070ee9aac3ae891613c1a8edcd94e8
- SHA512 bf75956fc9a5e60ff25a2f86889f30d564eb7bcfed4681325dbce39fbf12a490ef98712d4ebca7a2191a347061542689930e594abfcfbfe267f70d30403ba6a2
- SSDEEP 6144:S1QgrTZu458LqcWAv3R7TNrqZlDvtN2VeQ571GUBzesJJCnYrItZspXJOfQXvtE/:4X8PWAv3Kztq/RtewVEzsufQXvtk
- TLSH
  T13AA45E19A69802F9E1B7C179CAD64C06F772780A0770EEDF03948A765F276D04E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution spyware stealer
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing possible sandbox analysis VM names
- Detects executables containing possible sandbox analysis VM usernames
- Detects executables containing possible sandbox system UUIDs
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Drops file in Drivers directory
- Looks for VMWare Tools registry key
  defense_evasion
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2