General
- Target 2026-09-29_ad5746e59b50842a262ca74e1b8d1acd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 4.2MB
- Sample260930-v3fyrass2l
- SHA256 e2649726b153ee82c4e4ac0709b9e3fec5503c2a13cf410d416580057f34778a
- MD5 ad5746e59b50842a262ca74e1b8d1acd
- SHA1 0e023620b1dab43c69f32c322e2ad419bcf4186c
- SHA512 5cb02e630742ee7ab59fd30e581793268c8e66065a2c024fa0493fca75b2afe9f57163fd478416b513138d9f5305eb57ebaa21b650d868fc2fa1ad729746cc50
- SSDEEP 49152:GSX9RXNBYfzjV68NPLFs/6iNyGdqacTLhmR6I/GOTM10Tod6bMpdhW9:wSdq5OE64pdhw
- TLSH T105167B1BE6B940E5C0BBD1798A579617FAB2781A873197CB4790471A1F23BF09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_ad5746e59b50842a262ca74e1b8d1acd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260911-en
20 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-29_ad5746e59b50842a262ca74e1b8d1acd_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 4.2MB
- SHA256 e2649726b153ee82c4e4ac0709b9e3fec5503c2a13cf410d416580057f34778a
- MD5 ad5746e59b50842a262ca74e1b8d1acd
- SHA1 0e023620b1dab43c69f32c322e2ad419bcf4186c
- SHA512 5cb02e630742ee7ab59fd30e581793268c8e66065a2c024fa0493fca75b2afe9f57163fd478416b513138d9f5305eb57ebaa21b650d868fc2fa1ad729746cc50
- SSDEEP 49152:GSX9RXNBYfzjV68NPLFs/6iNyGdqacTLhmR6I/GOTM10Tod6bMpdhW9:wSdq5OE64pdhw
- TLSH T105167B1BE6B940E5C0BBD1798A579617FAB2781A873197CB4790471A1F23BF09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects Stealc stealer Version 3
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1