a4a192e9a5e3a1cbe8c3096ddbd86dab5e23ff29b4dd72b26fc83dc5d8e04e14

General

Target
2026-11-01_2a2bf0298e485033cc2988df8f48bd9c_cobalt-strike_coinminer_icedid_stealc_vidar
Size 30.5MB
Sample261101-tg2snabw2y
SHA256 a4a192e9a5e3a1cbe8c3096ddbd86dab5e23ff29b4dd72b26fc83dc5d8e04e14
MD5 2a2bf0298e485033cc2988df8f48bd9c
SHA1 a60a6dfe6985709589b81cf720a624bd01d622d0
SHA512 49bb291e90b245c67f42c6b241d88e05b55dc774c536d1c562d1f00942f93090be14e4d991269437c2feefc9b0357eab50b5784957186249a67f395fa568add3
SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYD:YC/p+HuPOc4+
TLSH
T11B67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-01_2a2bf0298e485033cc2988df8f48bd9c_cobalt-strike_coinminer_icedid_stealc_vidar
- Size 30.5MB
- SHA256 a4a192e9a5e3a1cbe8c3096ddbd86dab5e23ff29b4dd72b26fc83dc5d8e04e14
- MD5 2a2bf0298e485033cc2988df8f48bd9c
- SHA1 a60a6dfe6985709589b81cf720a624bd01d622d0
- SHA512 49bb291e90b245c67f42c6b241d88e05b55dc774c536d1c562d1f00942f93090be14e4d991269437c2feefc9b0357eab50b5784957186249a67f395fa568add3
- SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYD:YC/p+HuPOc4+
- TLSH
  T11B67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Custom signature
  
  Detects executables calling ClearMyTracksByProcess
- Custom signature
  
  Detects executables containing artifacts associated with disabling Widnows Defender
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies RDP port number used by Windows
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Indicator Removal: Clear Persistence
  Clear artifacts associated with previously established persistence like scheduletasks on a host.
  defense_evasion
- Drops file in System32 directory
behavioral1 behavioral2