General
- Target 2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 4.0MB
- Sample260820-sd17aael6s
- SHA256 37b25b9e4fd64d550acf2e4d22700d48621f76e216f9a8e21751d7e370ea3541
- MD5 964a4d672125b558a5e6811932565c82
- SHA1 c79cfe163101e992c2dc020ef4454430a2676a0e
- SHA512 3aa7606cc33f48fe93b63681f43ad1ad2e5c15ae4ed08936a0f618e9d01e793b0a3a15366219fabe0d0d21ffe8c9c68d6362b62bdf13b029873021620a70e68b
- SSDEEP 49152:c7EE3hXd5NHfrPqx0AAzXfuyaU0CBedbQ/dBZchqmb2BqZTd/d/54K5QTdqW:xjB89/dBa5d/542QTdqW
- TLSH T103167C07E6B941F4C0BBD13D8A569657FAB2785A877197CB43A0875A0F237E09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-20_964a4d672125b558a5e6811932565c82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 4.0MB
- SHA256 37b25b9e4fd64d550acf2e4d22700d48621f76e216f9a8e21751d7e370ea3541
- MD5 964a4d672125b558a5e6811932565c82
- SHA1 c79cfe163101e992c2dc020ef4454430a2676a0e
- SHA512 3aa7606cc33f48fe93b63681f43ad1ad2e5c15ae4ed08936a0f618e9d01e793b0a3a15366219fabe0d0d21ffe8c9c68d6362b62bdf13b029873021620a70e68b
- SSDEEP 49152:c7EE3hXd5NHfrPqx0AAzXfuyaU0CBedbQ/dBZchqmb2BqZTd/d/54K5QTdqW:xjB89/dBa5d/542QTdqW
- TLSH T103167C07E6B941F4C0BBD13D8A569657FAB2785A877197CB43A0875A0F237E09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1