General
- Target 2026-09-06_adc9cfcdd69fc1fceaeab05fd769f98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 3.9MB
- Sample260906-y7c97sdb75
- SHA256 45ffaf6a0413588aed3a7983be1655e393f9b49e07d3bd595b5dcc1e5dbbed8e
- MD5 adc9cfcdd69fc1fceaeab05fd769f98a
- SHA1 24e5f726fb39ba3ba361e6748c2a7f673fd6f7b6
- SHA512 a3ea81e73e030274b834c25d25d1eb1c4c489046b92c7ff808be033bf13f33cc19a42ca0124792dafe4b6d2ea847267efa7a6484507073845707ba64b65855df
- SSDEEP 49152:2OhZSWtOZvUrg8qptYgpADvbf2OQDSIGAauJc0GaTZbwfITQTqNuMrYnXqMKwfq1:3tO8qRFTauXjBrY6Tgw
- TLSH T19A167C4AE6B940E5C0BBD13D8A979657FAB13859C73197CB46A0871A1F237F09E3E340
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-06_adc9cfcdd69fc1fceaeab05fd769f98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-06_adc9cfcdd69fc1fceaeab05fd769f98a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 3.9MB
- SHA256 45ffaf6a0413588aed3a7983be1655e393f9b49e07d3bd595b5dcc1e5dbbed8e
- MD5 adc9cfcdd69fc1fceaeab05fd769f98a
- SHA1 24e5f726fb39ba3ba361e6748c2a7f673fd6f7b6
- SHA512 a3ea81e73e030274b834c25d25d1eb1c4c489046b92c7ff808be033bf13f33cc19a42ca0124792dafe4b6d2ea847267efa7a6484507073845707ba64b65855df
- SSDEEP 49152:2OhZSWtOZvUrg8qptYgpADvbf2OQDSIGAauJc0GaTZbwfITQTqNuMrYnXqMKwfq1:3tO8qRFTauXjBrY6Tgw
- TLSH T19A167C4AE6B940E5C0BBD13D8A979657FAB13859C73197CB46A0871A1F237F09E3E340
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1