161103c4201e52ce5ecb64506dbf32bf1b352858f2150f69e2ac7bfc9aa6ec10

General

Target
2026-08-11_2cdc76f3be6c6cd1ed66314bc0cc52b6_cobalt-strike_icedid_satacom_stealc
Size 5.9MB
Sample260811-rwaxdavekf
SHA256 161103c4201e52ce5ecb64506dbf32bf1b352858f2150f69e2ac7bfc9aa6ec10
MD5 2cdc76f3be6c6cd1ed66314bc0cc52b6
SHA1 c8b33ab787f63ece378c1d4d87c0a3ca5cc22d28
SHA512 7257c335d8c34679934615f2ee19aa21844c3ec835d57cae3da8512397f2f0558d8000a298bb105a3039b97a2ad9cf1bfdecaa5712ed04af054ffb34935f41c9
SSDEEP 49152:aii1mMlOoDGuBEjyZ3sjFRbGyl4RVZspNeQvLJ09nQtRccsHbZz1398CHGFdL4fR:ClbGuCjjmm4+dLGQc9bv3qCmFh4fJDj
TLSH
T1645618E620D2EFEDC426D57A4323F93F968F70390926B8A7A154E3265D2BC457724F08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-11_2cdc76f3be6c6cd1ed66314bc0cc52b6_cobalt-strike_icedid_satacom_stealc
- Size 5.9MB
- SHA256 161103c4201e52ce5ecb64506dbf32bf1b352858f2150f69e2ac7bfc9aa6ec10
- MD5 2cdc76f3be6c6cd1ed66314bc0cc52b6
- SHA1 c8b33ab787f63ece378c1d4d87c0a3ca5cc22d28
- SHA512 7257c335d8c34679934615f2ee19aa21844c3ec835d57cae3da8512397f2f0558d8000a298bb105a3039b97a2ad9cf1bfdecaa5712ed04af054ffb34935f41c9
- SSDEEP 49152:aii1mMlOoDGuBEjyZ3sjFRbGyl4RVZspNeQvLJ09nQtRccsHbZz1398CHGFdL4fR:ClbGuCjjmm4+dLGQc9bv3qCmFh4fJDj
- TLSH
  T1645618E620D2EFEDC426D57A4323F93F968F70390926B8A7A154E3265D2BC457724F08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery spyware stealer themida trojan
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables packed with Themida
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2