General
- Target 2026-08-09_341e9477539a4f93393c0e5d8eb64403_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 4.0MB
- Sample260809-vjm8qascpg
- SHA256 7f321d09f62bb1b7103b784bc2bb30f9db0654199e9409cb05a70b70546f20b5
- MD5 341e9477539a4f93393c0e5d8eb64403
- SHA1 22714e6f0a1b9dd6afd184913ad4edaf2a1d6abf
- SHA512 a131ad36e2974dd7bf832f3bc39d9fd469d3bf7850866a0ca5ee83f07d2d78f2a064da96b85ab78efee995d2a3a1582ad0f377e5bf9c5e506b6047414e57c4b0
- SSDEEP 49152:tbGegVwcsiC1eV74jsNf4Vqy88MJWGU+oC+pbNcBvBkAhhKa4FiTzEJjBoLNiXif:Roni1Ry9qo7wRGpj3
- TLSH T120168B07E7B940E4C4BAD13D8A969657FAB27849873197CB43A0871A5F237F09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_341e9477539a4f93393c0e5d8eb64403_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-09_341e9477539a4f93393c0e5d8eb64403_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 4.0MB
- SHA256 7f321d09f62bb1b7103b784bc2bb30f9db0654199e9409cb05a70b70546f20b5
- MD5 341e9477539a4f93393c0e5d8eb64403
- SHA1 22714e6f0a1b9dd6afd184913ad4edaf2a1d6abf
- SHA512 a131ad36e2974dd7bf832f3bc39d9fd469d3bf7850866a0ca5ee83f07d2d78f2a064da96b85ab78efee995d2a3a1582ad0f377e5bf9c5e506b6047414e57c4b0
- SSDEEP 49152:tbGegVwcsiC1eV74jsNf4Vqy88MJWGU+oC+pbNcBvBkAhhKa4FiTzEJjBoLNiXif:Roni1Ry9qo7wRGpj3
- TLSH T120168B07E7B940E4C4BAD13D8A969657FAB27849873197CB43A0871A5F237F09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1