75e32828d13c5d52a5278aece0b677a8ce01fe9e8490c91642769a7435948350

General

Target
2026-10-19_cd16362dbf91a434927310351023ce3c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample261020-lqbc3aah93
SHA256 75e32828d13c5d52a5278aece0b677a8ce01fe9e8490c91642769a7435948350
MD5 cd16362dbf91a434927310351023ce3c
SHA1 7dbc66bcb718b344f356794db45e6cad41f2d173
SHA512 5d8d1f311c3983524c090e7fd0594d0265b8f7ed2d5a0ff2e4b44c80f10a696f3c2ee97ae4f43d2ca6f413c892155cac37e5c55cd18b458f6da3d8ee66737a83
SSDEEP 6144:7sO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRZZLtzS:bH7F6cf6T7Ow5JR
TLSH
T1E1946D16EA65007DF1ABD13CCC574A02E6B5786E47A19ACF03E0C9A22F276D19F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  2026-10-19_cd16362dbf91a434927310351023ce3c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 75e32828d13c5d52a5278aece0b677a8ce01fe9e8490c91642769a7435948350
- MD5 cd16362dbf91a434927310351023ce3c
- SHA1 7dbc66bcb718b344f356794db45e6cad41f2d173
- SHA512 5d8d1f311c3983524c090e7fd0594d0265b8f7ed2d5a0ff2e4b44c80f10a696f3c2ee97ae4f43d2ca6f413c892155cac37e5c55cd18b458f6da3d8ee66737a83
- SSDEEP 6144:7sO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRZZLtzS:bH7F6cf6T7Ow5JR
- TLSH
  T1E1946D16EA65007DF1ABD13CCC574A02E6B5786E47A19ACF03E0C9A22F276D19F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution exploit persistence
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2