ce2c38d647e147de887087c16d20ae19ce6356aa9e188fbb4a20db394ab77bee

General

Target
2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc
Size 272KB
Sample261002-e95mpaysev
SHA256 ce2c38d647e147de887087c16d20ae19ce6356aa9e188fbb4a20db394ab77bee
MD5 b9cb349aad31d454aeced7349094aabc
SHA1 722cd2a4377f163ce6d6ca395ce20c11dfe97791
SHA512 0548e407457238d46bd2ef05030b96be612fbd0dc968e423fca2bcf15c1ce948e12f82e4273bed63154acdc7ce4e96747307d2271e3cb9c766496fff561d6816
SSDEEP 6144:ftpnOGcJZfLUNQaEFFXPaTWfldb/+HKmLI:F64QaEFFywlh
TLSH
T146444B15A6A40DF9E6B7867DCD964905EA73BC520B70EACF0390465B0F236D4CE3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-01_b9cb349aad31d454aeced7349094aabc_cobalt-strike_icedid_satacom_stealc
- Size 272KB
- SHA256 ce2c38d647e147de887087c16d20ae19ce6356aa9e188fbb4a20db394ab77bee
- MD5 b9cb349aad31d454aeced7349094aabc
- SHA1 722cd2a4377f163ce6d6ca395ce20c11dfe97791
- SHA512 0548e407457238d46bd2ef05030b96be612fbd0dc968e423fca2bcf15c1ce948e12f82e4273bed63154acdc7ce4e96747307d2271e3cb9c766496fff561d6816
- SSDEEP 6144:ftpnOGcJZfLUNQaEFFXPaTWfldb/+HKmLI:F64QaEFFywlh
- TLSH
  T146444B15A6A40DF9E6B7867DCD964905EA73BC520B70EACF0390465B0F236D4CE3E722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution exploit impact persistence privilege_escalation ransomware trojan
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies visibility of file extensions in Explorer
  defense_evasion
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Detects command variations typically used by ransomware
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Adds policy Run key to start application
  persistence
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Disables RegEdit via registry modification
  defense_evasion
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Disables service(s)
  defense_evasion execution
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
behavioral1 behavioral2