General
- Target 2026-09-04_1e32d079f891679f7a78fdc1bc878546_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 224KB
- Sample260905-veq4tawsbt
- SHA256 d66256223a423b626de168485cda22b806b379f4ad749aa4de7e708ee06ba012
- MD5 1e32d079f891679f7a78fdc1bc878546
- SHA1 34502e77cb996d7074ff3e16c6493b7574e9d6f7
- SHA512 859726cab255659a05825d215041d988b687ede801dad6cae9ad3289e2a6ca6c9a7e8dfd9d7659cab49f36f61ca85ecac06f9a17a06ebe8587a42ca4393a2d58
- SSDEEP 3072:4aoMHDBSYusigledM+nQZSgYyZcmYCnxltfQJa7iOwemmEXY:4aFB1usTrrfY4cOyJR
- TLSH T169246C1673A50CFEE4B38279C9624A42E6727C450760DBEF03E04667DF276E05D3AB62
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-04_1e32d079f891679f7a78fdc1bc878546_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-04_1e32d079f891679f7a78fdc1bc878546_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260710-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-04_1e32d079f891679f7a78fdc1bc878546_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 224KB
- SHA256 d66256223a423b626de168485cda22b806b379f4ad749aa4de7e708ee06ba012
- MD5 1e32d079f891679f7a78fdc1bc878546
- SHA1 34502e77cb996d7074ff3e16c6493b7574e9d6f7
- SHA512 859726cab255659a05825d215041d988b687ede801dad6cae9ad3289e2a6ca6c9a7e8dfd9d7659cab49f36f61ca85ecac06f9a17a06ebe8587a42ca4393a2d58
- SSDEEP 3072:4aoMHDBSYusigledM+nQZSgYyZcmYCnxltfQJa7iOwemmEXY:4aFB1usTrrfY4cOyJR
- TLSH T169246C1673A50CFEE4B38279C9624A42E6727C450760DBEF03E04667DF276E05D3AB62
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Enumerates VirtualBox registry keys
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.