a3caf9335f589c811fda620410e6db0bb1df114bdc32a885cab543d2079af100

General

Target
2026-08-09_f315ca88f6cfd6dfa32545afb2013ed8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample260809-nsx1yszyav
SHA256 a3caf9335f589c811fda620410e6db0bb1df114bdc32a885cab543d2079af100
MD5 f315ca88f6cfd6dfa32545afb2013ed8
SHA1 545f5c81c90e904d1739342f60b4ae2ad7888e39
SHA512 5280840e29fc18ecf5fa43f05e2342952580e1c85893224663d38a1da88899cb3ea7d245fa93b345f747c97c43ce4334681aabc2333e913e3a68ff0a83aa51c4
SSDEEP 6144:rsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRYZ3JzS:rH7F6cf6T7Ow5JR
TLSH
T1FD946C16EAA50079F1ABD578CC574902E6B5784E47E19ACF03E0C9B32F276E09B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-08-09_f315ca88f6cfd6dfa32545afb2013ed8_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 a3caf9335f589c811fda620410e6db0bb1df114bdc32a885cab543d2079af100
- MD5 f315ca88f6cfd6dfa32545afb2013ed8
- SHA1 545f5c81c90e904d1739342f60b4ae2ad7888e39
- SHA512 5280840e29fc18ecf5fa43f05e2342952580e1c85893224663d38a1da88899cb3ea7d245fa93b345f747c97c43ce4334681aabc2333e913e3a68ff0a83aa51c4
- SSDEEP 6144:rsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRYZ3JzS:rH7F6cf6T7Ow5JR
- TLSH
  T1FD946C16EAA50079F1ABD578CC574902E6B5784E47E19ACF03E0C9B32F276E09B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution exploit persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2