General
- Target 2026-08-03_a2e5708aaa3eb0831c6f2da56ec6c6dd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 7.1MB
- Sample260804-mhewyshe69
- SHA256 34daa1010c20ff9dc4901622ffcce1227a393d4567900f131a67be24ffa5c30d
- MD5 a2e5708aaa3eb0831c6f2da56ec6c6dd
- SHA1 cc7625f5c4321913d8233281e96ea9c37fd552a0
- SHA512 731e6e48b925b56592a67937baf50f5d195296e19eba32a37715a531cd02293f328bfa3295a8376dc3fa1f03583f4f76d2b829758fefd3545d1a9f96bded9edb
- SSDEEP 98304:bV8d6rcHRL/dUswebSMXsQYpaI0BMFH4TF:bV8Ired0ej1MFHK
- TLSH T11376AF1663E801ACF0B7D675CA265A13E9727CD91731E6DF06A0645D2E33BE08E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-08-03_a2e5708aaa3eb0831c6f2da56ec6c6dd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_a2e5708aaa3eb0831c6f2da56ec6c6dd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_a2e5708aaa3eb0831c6f2da56ec6c6dd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 7.1MB
- SHA256 34daa1010c20ff9dc4901622ffcce1227a393d4567900f131a67be24ffa5c30d
- MD5 a2e5708aaa3eb0831c6f2da56ec6c6dd
- SHA1 cc7625f5c4321913d8233281e96ea9c37fd552a0
- SHA512 731e6e48b925b56592a67937baf50f5d195296e19eba32a37715a531cd02293f328bfa3295a8376dc3fa1f03583f4f76d2b829758fefd3545d1a9f96bded9edb
- SSDEEP 98304:bV8d6rcHRL/dUswebSMXsQYpaI0BMFH4TF:bV8Ired0ej1MFHK
- TLSH T11376AF1663E801ACF0B7D675CA265A13E9727CD91731E6DF06A0645D2E33BE08E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables manipulated with Fody
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE