95148682cfdb00cac42579e542072adeaa2ef61a3d90e4b4e0d3a7259b9c1219

General

Target
2026-11-03_b63662839e61d52d9fa3691dd4c9ebe0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 401KB
Sample261104-l3a8tsvw2k
SHA256 95148682cfdb00cac42579e542072adeaa2ef61a3d90e4b4e0d3a7259b9c1219
MD5 b63662839e61d52d9fa3691dd4c9ebe0
SHA1 ad61f4c21589dc232ce34233fb9831577316321c
SHA512 b123223db2af01a81620d911403a7ab6be983ec2d902a9ae9f49ba7c1f2b49b88f6bfe4b9a899a55a82e55ae51f4b072a7db1ada9668de9d2c7519ae496dae7d
SSDEEP 6144:FsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRNZHjzS:1H7F6cf6T7Ow5JR
TLSH
T1BF947D1AEA652279E1F7913ECC574902E6B57C4D07A19ACF03D04BB2AF276D09B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-11-03_b63662839e61d52d9fa3691dd4c9ebe0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
- Size 401KB
- SHA256 95148682cfdb00cac42579e542072adeaa2ef61a3d90e4b4e0d3a7259b9c1219
- MD5 b63662839e61d52d9fa3691dd4c9ebe0
- SHA1 ad61f4c21589dc232ce34233fb9831577316321c
- SHA512 b123223db2af01a81620d911403a7ab6be983ec2d902a9ae9f49ba7c1f2b49b88f6bfe4b9a899a55a82e55ae51f4b072a7db1ada9668de9d2c7519ae496dae7d
- SSDEEP 6144:FsO/zba+IQbXxFaK6cfyIoT7Oqbv5F0GRNZHjzS:1H7F6cf6T7Ow5JR
- TLSH
  T1BF947D1AEA652279E1F7913ECC574902E6B57C4D07A19ACF03D04BB2AF276D09B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation
- Suspicious use of NtCreateProcessExOtherParentProcess
  defense_evasion privilege_escalation
- Suspicious use of NtCreateUserProcessOtherParentProcess
  defense_evasion privilege_escalation
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2