General
- Target 2026-08-24_086394ac8c02013092079e7b3a913f17_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 365KB
- Sample260825-yfh2daycja
- SHA256 1aee3b96faf222ca8f5747f051359da9620f656d711a0204f7e1fb6598a16406
- MD5 086394ac8c02013092079e7b3a913f17
- SHA1 e43e90414c1e25c70f4e6ad82cc33e3d26a30769
- SHA512 d7f04be084620a98a46dff075a96237ce5f6717aa24053ab7dcde8e5d9a41cbbf9728c67ea93f49b6e43a657a341ab454192bded5c48cfa96af816cbb476cb03
- SSDEEP 6144:prOSTWaI9EJPOgIADk7F0VTWjV6kjccUF4B+:oPPyJwkk76VaRsaB+
- TLSH T1A9847E26EB6804FDE07791B8C9634D06D772BC4A03B0AADF23A44E961F275E45E3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-24_086394ac8c02013092079e7b3a913f17_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_086394ac8c02013092079e7b3a913f17_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260710-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-24_086394ac8c02013092079e7b3a913f17_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 365KB
- SHA256 1aee3b96faf222ca8f5747f051359da9620f656d711a0204f7e1fb6598a16406
- MD5 086394ac8c02013092079e7b3a913f17
- SHA1 e43e90414c1e25c70f4e6ad82cc33e3d26a30769
- SHA512 d7f04be084620a98a46dff075a96237ce5f6717aa24053ab7dcde8e5d9a41cbbf9728c67ea93f49b6e43a657a341ab454192bded5c48cfa96af816cbb476cb03
- SSDEEP 6144:prOSTWaI9EJPOgIADk7F0VTWjV6kjccUF4B+:oPPyJwkk76VaRsaB+
- TLSH T1A9847E26EB6804FDE07791B8C9634D06D772BC4A03B0AADF23A44E961F275E45E3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Executes dropped EXE
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.