General
- Target 2026-08-04_c9f30293f0b0cb87112c3e8e99824a76_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 18.1MB
- Sample260804-wtly3st1cs
- SHA256 93dd3abdb5a667091e24aa691bbddbd4a6c431b67d088a2f2e36ba3e85f9bfbc
- MD5 c9f30293f0b0cb87112c3e8e99824a76
- SHA1 7748185bcda46c2eba03b51aa4f525e5fe857d3d
- SHA512 6049b4a39e177d44b7e9201bd37f843c167039c98909faf0885a215b05e749e0fa9eae05c725dfdb25469cf8764b3b465a7c9ba39102451d61062906e1c73484
- SSDEEP 196608:3Pq+b5Nt+8NxTrZY7tEZpVcE/Ks1Q+LG249JRscc2fxEU9eVTnXR:fq+b5aeOXET1hG249rscc2pvIph
- TLSH T1ED179E46F2A251E8D577C074C266AA17FB7438BD43502AF79AD19A746F23BE06D3B300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_c9f30293f0b0cb87112c3e8e99824a76_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_c9f30293f0b0cb87112c3e8e99824a76_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_c9f30293f0b0cb87112c3e8e99824a76_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 18.1MB
- SHA256 93dd3abdb5a667091e24aa691bbddbd4a6c431b67d088a2f2e36ba3e85f9bfbc
- MD5 c9f30293f0b0cb87112c3e8e99824a76
- SHA1 7748185bcda46c2eba03b51aa4f525e5fe857d3d
- SHA512 6049b4a39e177d44b7e9201bd37f843c167039c98909faf0885a215b05e749e0fa9eae05c725dfdb25469cf8764b3b465a7c9ba39102451d61062906e1c73484
- SSDEEP 196608:3Pq+b5Nt+8NxTrZY7tEZpVcE/Ks1Q+LG249JRscc2fxEU9eVTnXR:fq+b5aeOXET1hG249rscc2pvIph
- TLSH T1ED179E46F2A251E8D577C074C266AA17FB7438BD43502AF79AD19A746F23BE06D3B300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
UAC bypass
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1