568c227af628c987686c6dd9b2ed83021dee3e3f8fc884ac6a768d985cd9558c

Analysis

max time kernel
149s
max time network
103s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 04:00

Target
2026-06-04_68963008d2851e86321112f3de8d6de3_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 603KB
Sample260604-eknymsax9l
SHA256 568c227af628c987686c6dd9b2ed83021dee3e3f8fc884ac6a768d985cd9558c
MD5 68963008d2851e86321112f3de8d6de3
SHA1 07dfe103466c1e768b66c3c14cd2e81986d92999
SHA512 534bf12a239466d4e1b514d074f1fc4d5ac0ad48c65823841d586c4368bb4c4d5c7c8650913aaf5c9b0062baa97c04f253e28796815505e9ef2acad9ab9322c3
SSDEEP 12288:tNGG3U3ITEmUbqLEL3G/RMSCb027dLuReV+HnZ5PN:tAIAmUbqojGRMDdLuAVAj
TLSH
T1B2D4D015FBA814F9E277C13CCD634606EA727C5A0761D7CB13A44AA62F23AD09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

C:\Users\Admin\AppData\Local\Temp\2026-06-04_68963008d2851e86321112f3de8d6de3_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_68963008d2851e86321112f3de8d6de3_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
PID:5548