General
- Target 2026-08-09_6f2b7484eaed725e89dca1dac5e6bc21_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 3.9MB
- Sample260809-k4m4cahf92
- SHA256 d8644a5ae2a7726e9ccf444c7d34e6cbe9c1df44cda199bf0a14b9b3b1eef0ca
- MD5 6f2b7484eaed725e89dca1dac5e6bc21
- SHA1 fafa231c6a6e77c1d39eb00ae4820170d65ca8ef
- SHA512 a2d39d94dc83877be11f5a39c8eeb553bbb26ec0e9b5978402ec1b5cbc0ce04c47cd094255dda877b3a47bc36783ca5785f7bff4bb5b3cf1267df9045ff36553
- SSDEEP 49152:pi0BBWtOZvUrg8qptYgpADvbf2OQDSIGAauJc0GaTZbwfITQTqFuIuImYW78R:AtO8qRFTauXv3uImt
- TLSH T13B167C0AE6B940E5D0BBD13D8A979647FAB13859C73197CB46A1871A1F237F09E3E340
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_6f2b7484eaed725e89dca1dac5e6bc21_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_6f2b7484eaed725e89dca1dac5e6bc21_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 3.9MB
- SHA256 d8644a5ae2a7726e9ccf444c7d34e6cbe9c1df44cda199bf0a14b9b3b1eef0ca
- MD5 6f2b7484eaed725e89dca1dac5e6bc21
- SHA1 fafa231c6a6e77c1d39eb00ae4820170d65ca8ef
- SHA512 a2d39d94dc83877be11f5a39c8eeb553bbb26ec0e9b5978402ec1b5cbc0ce04c47cd094255dda877b3a47bc36783ca5785f7bff4bb5b3cf1267df9045ff36553
- SSDEEP 49152:pi0BBWtOZvUrg8qptYgpADvbf2OQDSIGAauJc0GaTZbwfITQTqFuIuImYW78R:AtO8qRFTauXv3uImt
- TLSH T13B167C0AE6B940E5D0BBD13D8A979647FAB13859C73197CB46A1871A1F237F09E3E340
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1