General
- Target 2026-08-23_1bb5152be0eef4edec8bcf12a8460f67_cobalt-strike_icedid_luca-stealer_njrat
- Size 935KB
- Sample260824-tp164aam2w
- SHA256 148d84a82627fd936fdb9378cefd28cb8f1fd6a7adcf2f8a56d5b952c192e219
- MD5 1bb5152be0eef4edec8bcf12a8460f67
- SHA1 f5381b3cd3d1a7fa21711588ab12440297c0fb61
- SHA512 7a7758f3c3ad8960745073944071f0c7b28e6605c5a7da99f5c47a84e7e4eb2581ef9c3d964014dd2c258290ac7f335afded1b3781bdb0a6bff14bc94ec7bb0f
- SSDEEP 24576:WpXA4zQoRbeIzW4iEZ31m2RB2+siA/M8:WptDiEB1vRId/
- TLSH T19B15F142779716EAE6738D3889A2D312EF32F8560B65D7CF63900EE12D272D01D39B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Behavioral task
behavioral1
Sample
2026-08-23_1bb5152be0eef4edec8bcf12a8460f67_cobalt-strike_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_1bb5152be0eef4edec8bcf12a8460f67_cobalt-strike_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-23_1bb5152be0eef4edec8bcf12a8460f67_cobalt-strike_icedid_luca-stealer_njrat
- Size 935KB
- SHA256 148d84a82627fd936fdb9378cefd28cb8f1fd6a7adcf2f8a56d5b952c192e219
- MD5 1bb5152be0eef4edec8bcf12a8460f67
- SHA1 f5381b3cd3d1a7fa21711588ab12440297c0fb61
- SHA512 7a7758f3c3ad8960745073944071f0c7b28e6605c5a7da99f5c47a84e7e4eb2581ef9c3d964014dd2c258290ac7f335afded1b3781bdb0a6bff14bc94ec7bb0f
- SSDEEP 24576:WpXA4zQoRbeIzW4iEZ31m2RB2+siA/M8:WptDiEB1vRId/
- TLSH T19B15F142779716EAE6738D3889A2D312EF32F8560B65D7CF63900EE12D272D01D39B42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Looks for VirtualBox Guest Additions in registry
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Looks for VMWare Tools registry key
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger