b0c30ec72b96cb02481ef26a5fd1f8b623a904123338204dd6feb5c533bc0e3e

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 15:50

Target
2026-06-03_385ea4ba125fc58c3af2e56ec346adaa_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 494KB
Sample260603-tabmwsbs5s
SHA256 b0c30ec72b96cb02481ef26a5fd1f8b623a904123338204dd6feb5c533bc0e3e
MD5 385ea4ba125fc58c3af2e56ec346adaa
SHA1 b380466d6e5abf72eb02b6a134dfcc4f7860877a
SHA512 5c491b80627799fd9f2e20da8149bee9a7293c2c54ae6ff072899c7968249fdf516e0a6ff8544d15957e13b5bac0c98503f1bbf03fd1c9b11175ed2ee8fffd89
SSDEEP 6144:1l3VfGYBZj7Oa7Q0s9Sk82ro9mTb9cLEfzxFegSM2foa4r4Hb271EepZWUBttsX5:bNGG3U3ITEmUbqLELGOr4wLpZBttj0
TLSH
T1F2B4BF55EBA814F9E277C53CCD634606EA727C9A0770A7CF23A449962F236D08E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

C:\Users\Admin\AppData\Local\Temp\2026-06-03_385ea4ba125fc58c3af2e56ec346adaa_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_385ea4ba125fc58c3af2e56ec346adaa_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
PID:1228