Overview

overview

9

Static

static

3

2026-08-11...ar.exe

windows10-2004-x64

9

2026-08-11...ar.exe

windows11-ltsc_2024-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-08-11_b1570dc3d7d190b243cf71fefa6724d3_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
  • Size 14.4MB
  • Sample260811-c171cael2y
  • SHA256 08d9d48206b8598db402eb9b0d3c1b67036dbf3d25ad5537d3463e8ffcb56b89
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
credential_accessdiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Targets

    • Target
      2026-08-11_b1570dc3d7d190b243cf71fefa6724d3_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
    • Size 14.4MB
    • SHA256 08d9d48206b8598db402eb9b0d3c1b67036dbf3d25ad5537d3463e8ffcb56b89
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    credential_accessdiscoveryspywarestealerpersistenceprivilege_escalation

    • Detects executables containing URLs to raw contents of a Github gist

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks