General
- Target 2026-08-03_3fd5629bafaad0d37cb3e482f6469085_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc
- Size 63.7MB
- Sample260804-pgs4asah88
- SHA256 77cfa242b11198d9ba724bc5caee2e04df416cf319bdb03b1310647be80364cb
- MD5 3fd5629bafaad0d37cb3e482f6469085
- SHA1 176db41a8b8723c33871e28f77be8f1971f9e81a
- SHA512 04b8672f950d2f6ec60c09c8ce4781f545dc82da0e6a04637d9bbddc6486e60f273fee8a6353eb73e681157fc77ca1e39b89227c1bd714194149724633a94f8f
- SSDEEP 786432:vjH9z2dnQFRPZxmKIr/QGS9YQ0gUBheXi5yQfist:vr9z2dnQFpZxmFr/QGSR0g2UX+
- TLSH T123E7414C24110EE891ABE815AA67CF1B5FE9D6EB4BE8254DBCA58E340CD3CF7191074B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_3fd5629bafaad0d37cb3e482f6469085_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_3fd5629bafaad0d37cb3e482f6469085_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_3fd5629bafaad0d37cb3e482f6469085_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc
- Size 63.7MB
- SHA256 77cfa242b11198d9ba724bc5caee2e04df416cf319bdb03b1310647be80364cb
- MD5 3fd5629bafaad0d37cb3e482f6469085
- SHA1 176db41a8b8723c33871e28f77be8f1971f9e81a
- SHA512 04b8672f950d2f6ec60c09c8ce4781f545dc82da0e6a04637d9bbddc6486e60f273fee8a6353eb73e681157fc77ca1e39b89227c1bd714194149724633a94f8f
- SSDEEP 786432:vjH9z2dnQFRPZxmKIr/QGS9YQ0gUBheXi5yQfist:vr9z2dnQFpZxmFr/QGSR0g2UX+
- TLSH T123E7414C24110EE891ABE815AA67CF1B5FE9D6EB4BE8254DBCA58E340CD3CF7191074B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger