General
- Target 2026-08-07_cfa13ad9ffffb9a9f2932cfa457d8450_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 3.9MB
- Sample260807-lt4tsabm7w
- SHA256 9248bb4e87db6f768f8cd3261084c3abdbf78caf2bd15e4458769265a689c51f
- MD5 cfa13ad9ffffb9a9f2932cfa457d8450
- SHA1 ac78851d06b74b3695b92d5ab38f9d48e4147f97
- SHA512 d61749964f5a2603685e9fc145a626e4c7e62a6c59dcda577cb20a73b3bfaf80a50b2f9bab06fce5d0310162542ba5876702902a632612aecb6bcb7c14348906
- SSDEEP 49152:MiTJWWtOZvUrg8qptYgpADvbf2OQDSIGAauJc0GaTZbwfITQTqh4Yhc9/kKa0Rsu:LtO8qRFTauXfHWMyN
- TLSH T1F1167C06E6B940E5C0BBD13D8A979657FAB1385AC73197CB46A1835A1F237F09E3E340
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_cfa13ad9ffffb9a9f2932cfa457d8450_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-07_cfa13ad9ffffb9a9f2932cfa457d8450_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 3.9MB
- SHA256 9248bb4e87db6f768f8cd3261084c3abdbf78caf2bd15e4458769265a689c51f
- MD5 cfa13ad9ffffb9a9f2932cfa457d8450
- SHA1 ac78851d06b74b3695b92d5ab38f9d48e4147f97
- SHA512 d61749964f5a2603685e9fc145a626e4c7e62a6c59dcda577cb20a73b3bfaf80a50b2f9bab06fce5d0310162542ba5876702902a632612aecb6bcb7c14348906
- SSDEEP 49152:MiTJWWtOZvUrg8qptYgpADvbf2OQDSIGAauJc0GaTZbwfITQTqh4Yhc9/kKa0Rsu:LtO8qRFTauXfHWMyN
- TLSH T1F1167C06E6B940E5C0BBD13D8A979657FAB1385AC73197CB46A1835A1F237F09E3E340
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1