e0f9c3c5191c53601f070ac2061ae8c126795711221e6f79916ef50029c9123a

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 05:09

Target
2026-06-05_8900b857375ee34d5d65707f80de07b2_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 658KB
Sample260605-ftam2sa17w
SHA256 e0f9c3c5191c53601f070ac2061ae8c126795711221e6f79916ef50029c9123a
MD5 8900b857375ee34d5d65707f80de07b2
SHA1 f0d95e72b7171e580941e0409e861695abf23c55
SHA512 3560e8c86a25e184fafcad6dfd99ecfa7b6bd4611795531d1ce8f9262d4762d12343fe28fcab8f73bd1db8ba3b45beba446d704996fa9e1aeb8c4604d2c28323
SSDEEP 12288:eNGG3U3ITEmUbqLELGQ5QMQnQuX+CQorITpxNkBBbD2OVAV7JnsRs5Jg0hgkWnxY:YAIAmUbqoaQ5QMQnQuX+CQDNjk/baOq/
TLSH
T1E5E4D015FAA810F9E177D13CCE638606EA717C990760DBCF23A44A962F236D19E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

C:\Users\Admin\AppData\Local\Temp\2026-06-05_8900b857375ee34d5d65707f80de07b2_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-05_8900b857375ee34d5d65707f80de07b2_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
PID:3340