Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/09/2026, 16:42
Behavioral task
behavioral1
Sample
2026-09-22_e548cf812ca4e4d777f519152b590266_cobalt-strike_icedid_luca-stealer_njrat_ryuk_stealc_voidlink.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-22_e548cf812ca4e4d777f519152b590266_cobalt-strike_icedid_luca-stealer_njrat_ryuk_stealc_voidlink.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target 2026-09-22_e548cf812ca4e4d777f519152b590266_cobalt-strike_icedid_luca-stealer_njrat_ryuk_stealc_voidlink.exe
- Size 644KB
- Sample260922-t77ftstv7j
- SHA256 5bef4668d451dc2321f497f30abc3644b16d391ea97e6e879da6969296dfd401
- MD5 e548cf812ca4e4d777f519152b590266
- SHA1 13cea53c69618346bc0243e49365090b9477f9e5
- SHA512 d727b961e2dd3be62ba76fcd8b6cced139d2199f1d7c5871976ccb504fa5e645e2042f9c08fced0b1a3312ec58428ff6d7b0d53704192c4cc94b174300393d40
- SSDEEP 6144:iZdMgMpXs8klSYyiw48NoFnqPYNjszOjQSdhpC5IXe:zXXlYy748K8YNjsoXpGI
- TLSH T1C0E48C07F69448F9E866C5798A4AC522F672BC054B60F2DF07D44EA36E33AD09E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/4396-0-0x0000000000590000-0x0000000000641000-memory.dmp UPX behavioral2/memory/4396-1-0x0000000000590000-0x0000000000641000-memory.dmp UPX -
resource yara_rule behavioral2/memory/4396-0-0x0000000000590000-0x0000000000641000-memory.dmp upx behavioral2/memory/4396-1-0x0000000000590000-0x0000000000641000-memory.dmp upx
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-22_e548cf812ca4e4d777f519152b590266_cobalt-strike_icedid_luca-stealer_njrat_ryuk_stealc_voidlink.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-22_e548cf812ca4e4d777f519152b590266_cobalt-strike_icedid_luca-stealer_njrat_ryuk_stealc_voidlink.exe"1⤵PID:4396