General
- Target 2026-11-01_a22f616932df79f7772bee3ac2cdefc4_cobalt-strike_icedid_luca-stealer_njrat_stealc
- Size 422KB
- Sample261102-qb37ract6l
- SHA256 f3e6ad95fbfe70950e6d2ef69b82aa5809276adc46807408d8ba4286a4a61588
- MD5 a22f616932df79f7772bee3ac2cdefc4
- SHA1 9d91ac2f723d1bb2af9c3cd965d9d064bd3a4303
- SHA512 2db510b7c040b816b440edf47c713c6621c61f356130e121b002cb51bc293a25e698d5a141d3872d02539501ec4ac5edb79aa12214e76a40885446f86b5c495e
- SSDEEP 6144:lR18HjgKoNXhFhTFj0m+BiYRs6jSFny2Z5Z9G9PpftzE/QMEC/eKxb:31Kzm3S8nyQOpftzDMEJSb
- TLSH T169946D26D79405F8E1B7D274CD578942EB717C0A43E1EADF03D499A21E276E09E3EB02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-11-01_a22f616932df79f7772bee3ac2cdefc4_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_a22f616932df79f7772bee3ac2cdefc4_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-01_a22f616932df79f7772bee3ac2cdefc4_cobalt-strike_icedid_luca-stealer_njrat_stealc
- Size 422KB
- SHA256 f3e6ad95fbfe70950e6d2ef69b82aa5809276adc46807408d8ba4286a4a61588
- MD5 a22f616932df79f7772bee3ac2cdefc4
- SHA1 9d91ac2f723d1bb2af9c3cd965d9d064bd3a4303
- SHA512 2db510b7c040b816b440edf47c713c6621c61f356130e121b002cb51bc293a25e698d5a141d3872d02539501ec4ac5edb79aa12214e76a40885446f86b5c495e
- SSDEEP 6144:lR18HjgKoNXhFhTFj0m+BiYRs6jSFny2Z5Z9G9PpftzE/QMEC/eKxb:31Kzm3S8nyQOpftzDMEJSb
- TLSH T169946D26D79405F8E1B7D274CD578942EB717C0A43E1EADF03D499A21E276E09E3EB02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Adds Run key to start application