General
- Target 2026-10-28_5338aae805ac706e8bd17fa7a54afd65_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 4.2MB
- Sample261030-e6zx2adc36
- SHA256 994b6f8f780dcc00194ef4428807d547a20224a8aff0debbdea119dbd2e9acbc
- MD5 5338aae805ac706e8bd17fa7a54afd65
- SHA1 aafeff4cdaa94a5a860b8e0d112bc390f4061f1b
- SHA512 a93b7e0ff6848df193d245545a1232d0104090f03215848136c3fbf05efaa7682ec0c614f5fd16c797d6696980df62da7c5aa850bd99c2efa795f5ce5227f37f
- SSDEEP 49152:gSX9RXNBYfzjV68NPYFs/6iNyGdqacTLhmR6I/GOTM1M0VY3vSi+ttr+Ekw7n2m:XSdq5Op0S/Si+ttrsw7n2m
- TLSH T123167B1BE6B940E5C0BBD1798A579617FAB2781A873197CB4790471A1F23BF09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-28_5338aae805ac706e8bd17fa7a54afd65_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-28_5338aae805ac706e8bd17fa7a54afd65_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
- Size 4.2MB
- SHA256 994b6f8f780dcc00194ef4428807d547a20224a8aff0debbdea119dbd2e9acbc
- MD5 5338aae805ac706e8bd17fa7a54afd65
- SHA1 aafeff4cdaa94a5a860b8e0d112bc390f4061f1b
- SHA512 a93b7e0ff6848df193d245545a1232d0104090f03215848136c3fbf05efaa7682ec0c614f5fd16c797d6696980df62da7c5aa850bd99c2efa795f5ce5227f37f
- SSDEEP 49152:gSX9RXNBYfzjV68NPYFs/6iNyGdqacTLhmR6I/GOTM1M0VY3vSi+ttr+Ekw7n2m:XSdq5Op0S/Si+ttrsw7n2m
- TLSH T123167B1BE6B940E5C0BBD1798A579617FAB2781A873197CB4790471A1F23BF09E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1