maxlocker | 3a5fdbfb2ba1b17dbc855f3ab3e5cbf8362a627fc957f95319d25bd2f5b1ed01 | Triage™

Login
Reports

Overview

overview

Static

static

2026-08-14...at.exe

windows10-2004-x64

9

2026-08-14...at.exe

windows11-ltsc_2024-x64

9

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_aa06623fbe1e169df89ab84c12cb3b73_cobalt-strike_icedid_luca-stealer_njrat
Size 936KB
Sample260814-d4q2nseh98
SHA256 3a5fdbfb2ba1b17dbc855f3ab3e5cbf8362a627fc957f95319d25bd2f5b1ed01
MD5 aa06623fbe1e169df89ab84c12cb3b73
SHA1 c60389088a8f40239849eb596564eff13b5c269d
SHA512 2e27a8cbd3db12d2f64d806155fa2791bf77bcf2544083fa0f76c806deee020046f842ecf0b8eebc3745e42a7f9c21456de7c9cf810b1abb159f98df2251e9f7
SSDEEP 24576:5pXA40QoRbeIzW4iEZ31m2Rx2+siA/s8:5pgDiEB1vRYd/
TLSH
T1B815F142779716EAE6738D3889A2D312EF32F8560B65D7CF63900EE52D232D01D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

maxlocker defense_evasion persistence stealer

Static task

static1

4 signatures

stealer maxlocker

Behavioral task

behavioral1

Sample

2026-08-14_aa06623fbe1e169df89ab84c12cb3b73_cobalt-strike_icedid_luca-stealer_njrat.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

8 signatures

150 seconds

defense_evasion persistence

Behavioral task

behavioral2

Sample

2026-08-14_aa06623fbe1e169df89ab84c12cb3b73_cobalt-strike_icedid_luca-stealer_njrat.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

8 signatures

150 seconds

defense_evasion persistence

Malware Config

Targets

- Target
  2026-08-14_aa06623fbe1e169df89ab84c12cb3b73_cobalt-strike_icedid_luca-stealer_njrat
- Size 936KB
- SHA256 3a5fdbfb2ba1b17dbc855f3ab3e5cbf8362a627fc957f95319d25bd2f5b1ed01
- MD5 aa06623fbe1e169df89ab84c12cb3b73
- SHA1 c60389088a8f40239849eb596564eff13b5c269d
- SHA512 2e27a8cbd3db12d2f64d806155fa2791bf77bcf2544083fa0f76c806deee020046f842ecf0b8eebc3745e42a7f9c21456de7c9cf810b1abb159f98df2251e9f7
- SSDEEP 24576:5pXA40QoRbeIzW4iEZ31m2Rx2+siA/s8:5pgDiEB1vRYd/
- TLSH
  T1B815F142779716EAE6738D3889A2D312EF32F8560B65D7CF63900EE52D232D01D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Query Registry

Virtualization/Sandbox Evasion

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

stealermaxlocker

behavioral1

defense_evasionpersistence

behavioral2

defense_evasionpersistence

© 2018-2026

Terms | Privacy