3b37f9a6f87127dfc5b8816bd27f47beb7dfa565c8aa30e5f931f0d805752af3

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 04:09

Target
2026-06-04_834d2d5c8a022d3641692e3bbab5d535_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 511KB
Sample260604-eqz8vsay6j
SHA256 3b37f9a6f87127dfc5b8816bd27f47beb7dfa565c8aa30e5f931f0d805752af3
MD5 834d2d5c8a022d3641692e3bbab5d535
SHA1 73b4f24cba7ccd663bff9da0fdd7597df2343212
SHA512 d8eb592805be06891e8ac12f4fd87ae42647a32ed2fd623681fb544ee47f2546e1b99a0250f8cc16205b2fd97755b8971373bbde6182b6da9b00d2478d44a92f
SSDEEP 12288:RNGG3U3ITEmUbqLELzJ/8UAZjQRqJnWlZ7L:RAIAmUbqoHF8UAZjkq0lZ/
TLSH
T1B1B4C055FBA414FDE273817CCD638602EA727C5A076097CF13A48A962F23AD19E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

C:\Users\Admin\AppData\Local\Temp\2026-06-04_834d2d5c8a022d3641692e3bbab5d535_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_834d2d5c8a022d3641692e3bbab5d535_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
PID:792