General
- Target 2026-08-21_87198d0c61affeec5999549df3c38246_cobalt-strike_coinminer_icedid_luca-stealer_njrat_remcos_ryuk_satacom_vidar
- Size 20.7MB
- Sample260822-nba5vsgm2z
- SHA256 0621b6f1bc9b6e95d41341f89531a7799f7ca05242af586f7157b5282c461c68
- MD5 87198d0c61affeec5999549df3c38246
- SHA1 e3e5ca2ef0e6efd6b7b51d2d9702b4a6193a0224
- SHA512 9836de722fc8cc8900fbc5e9636e64031c3bdaca43393d5c084168d59170f2191b131e21a827096556cb16350051935864e0cad78019cd1fb617d72f8543860d
- SSDEEP 393216:ssnzfdNO5zWzevo9uSPiBV4VVWiNs1LeHns5UmW:Pjdo5zEKiuSPiBV8s1LY
- TLSH T15A27AFE330D25299C816D5BF8712FE6FDE9F713A0A26DDD3615CB6668813C407E08E29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-21_87198d0c61affeec5999549df3c38246_cobalt-strike_coinminer_icedid_luca-stealer_njrat_remcos_ryuk_satacom_vidar.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_87198d0c61affeec5999549df3c38246_cobalt-strike_coinminer_icedid_luca-stealer_njrat_remcos_ryuk_satacom_vidar.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-21_87198d0c61affeec5999549df3c38246_cobalt-strike_coinminer_icedid_luca-stealer_njrat_remcos_ryuk_satacom_vidar
- Size 20.7MB
- SHA256 0621b6f1bc9b6e95d41341f89531a7799f7ca05242af586f7157b5282c461c68
- MD5 87198d0c61affeec5999549df3c38246
- SHA1 e3e5ca2ef0e6efd6b7b51d2d9702b4a6193a0224
- SHA512 9836de722fc8cc8900fbc5e9636e64031c3bdaca43393d5c084168d59170f2191b131e21a827096556cb16350051935864e0cad78019cd1fb617d72f8543860d
- SSDEEP 393216:ssnzfdNO5zWzevo9uSPiBV4VVWiNs1LeHns5UmW:Pjdo5zEKiuSPiBV8s1LY
- TLSH T15A27AFE330D25299C816D5BF8712FE6FDE9F713A0A26DDD3615CB6668813C407E08E29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables packed with Themida
-
Suspicious use of NtCreateThreadExHideFromDebugger