b0abcdbeffd3d16b1afe2961830284defa4eee398eae0157db34437fc498752a

General

Target
2026-08-06_29f7bde02a54a5e1a3c40facddf3ea81_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 398KB
Sample260806-3c47nashmg
SHA256 b0abcdbeffd3d16b1afe2961830284defa4eee398eae0157db34437fc498752a
MD5 29f7bde02a54a5e1a3c40facddf3ea81
SHA1 40d5fdb59ee56a036725881cf6e35118dc5e0a19
SHA512 eefb7548516ca1b93a8436f1a359554f46f998019b611ec49794ef996f8fa287ea5eb7ffa2523a9463d8c5287468822a3e45bbac2b1d8a9eceed45e31961cfe5
SSDEEP 6144:/8Q+mE3zWTXAucKLYyrMPFCIfNh4xFb3p6BmmeGdi/RVq+d7w:/ulKkyrMQIfNWFDpiTiT
TLSH
T178848D15EA64317DE1EBD279C8534902E7F67C4A07A99BCF03D109A62F276E09B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-08-06_29f7bde02a54a5e1a3c40facddf3ea81_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 398KB
- SHA256 b0abcdbeffd3d16b1afe2961830284defa4eee398eae0157db34437fc498752a
- MD5 29f7bde02a54a5e1a3c40facddf3ea81
- SHA1 40d5fdb59ee56a036725881cf6e35118dc5e0a19
- SHA512 eefb7548516ca1b93a8436f1a359554f46f998019b611ec49794ef996f8fa287ea5eb7ffa2523a9463d8c5287468822a3e45bbac2b1d8a9eceed45e31961cfe5
- SSDEEP 6144:/8Q+mE3zWTXAucKLYyrMPFCIfNh4xFb3p6BmmeGdi/RVq+d7w:/ulKkyrMQIfNWFDpiTiT
- TLSH
  T178848D15EA64317DE1EBD279C8534902E7F67C4A07A99BCF03D109A62F276E09B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution exploit persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2