bf61988409bd60e3e526649e0b6be8b0e956fda9afffa87d0883ef60e3887498

General

Target
2026-08-31_97b0ebc38a75d7cdacc1dd9b52aac33a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample260831-vd4crayyft
SHA256 bf61988409bd60e3e526649e0b6be8b0e956fda9afffa87d0883ef60e3887498
MD5 97b0ebc38a75d7cdacc1dd9b52aac33a
SHA1 76231ea76611e35047bc1bc69bf0de9c30659904
SHA512 11bee85d02fb47e3db9da766bce77715615e0ed349e344da196e9de553165dedd603067ca12768f2b6bd9def01f15e7f31269d948fb6776b3b3e0397d5c07dbf
SSDEEP 6144:ZsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRTZJbzS:xH7F6cf6T7Ow5JR
TLSH
T1CE947D16EA64007DF1B79178CC574B02E6B9784E07A39ACF03D0C9A26FA76E19B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-08-31_97b0ebc38a75d7cdacc1dd9b52aac33a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 bf61988409bd60e3e526649e0b6be8b0e956fda9afffa87d0883ef60e3887498
- MD5 97b0ebc38a75d7cdacc1dd9b52aac33a
- SHA1 76231ea76611e35047bc1bc69bf0de9c30659904
- SHA512 11bee85d02fb47e3db9da766bce77715615e0ed349e344da196e9de553165dedd603067ca12768f2b6bd9def01f15e7f31269d948fb6776b3b3e0397d5c07dbf
- SSDEEP 6144:ZsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRTZJbzS:xH7F6cf6T7Ow5JR
- TLSH
  T1CE947D16EA64007DF1B79178CC574B02E6B9784E07A39ACF03D0C9A26FA76E19B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution exploit persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2