Behavioral task
behavioral1
Sample
2025-04-20_bad656e535d3ff64f103a37373ac61b9_black-basta_cobalt-strike_satacom.exe
Resource
win10v2004-20250410-en
Behavioral task
behavioral2
Sample
2025-04-20_bad656e535d3ff64f103a37373ac61b9_black-basta_cobalt-strike_satacom.exe
Resource
win11-20250411-en
General
-
Target
2025-04-20_bad656e535d3ff64f103a37373ac61b9_black-basta_cobalt-strike_satacom
-
Size
2.4MB
-
MD5
bad656e535d3ff64f103a37373ac61b9
-
SHA1
54e00fc7d6912e89e32918d5844e210fa20a4111
-
SHA256
ee8ba43c89783e92efcab010e8ed82f6d2340cff060a0cdfe29d1e0467a88fdc
-
SHA512
5343db0c97b8fe1d9383953a8cfc3c6491ec05cf35800bebd616eda0e136edb1b8d0aadfa59e424d51494a44afdfbfcb14dc7e2ab28d6c04336ceb309cd59ddb
-
SSDEEP
24576:xA8oUFnXSs9CHdSJpikCs7MI6qv4cpF6kECSbxvHFXT3ru/9qtrQy5:7oUlSs9CHagVsYI6SDxECSbHXT3rzth5
Malware Config
Extracted
stealc
suka
45.93.20.28
-
url_path
/3d15e67552d448ff.php
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-04-20_bad656e535d3ff64f103a37373ac61b9_black-basta_cobalt-strike_satacom
Files
-
2025-04-20_bad656e535d3ff64f103a37373ac61b9_black-basta_cobalt-strike_satacom.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 312KB - Virtual size: 804KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 788B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gemyohmr Size: 2.0MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sdjyqixw Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE