a1ada850a86fd59d82d34c6da1be875a8a50b9885b3056b770d73d1d7a000d74

Analysis

max time kernel
149s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 22:32

Target
2026-06-08_9a5e60780f1b8929d652403b20c61fa1_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 723KB
Sample260608-2f3mkagw4k
SHA256 a1ada850a86fd59d82d34c6da1be875a8a50b9885b3056b770d73d1d7a000d74
MD5 9a5e60780f1b8929d652403b20c61fa1
SHA1 5fa74db75efbfbcae5393472d667e32e62bd57fa
SHA512 e0612073f0a3c9cf0aace9b7ce658fca83f82d00e0359184a834688312a33fb41c21681dd87d73adb00c4a4e15399abbf2b8a0ae698eee86f62a44057bba8ae2
SSDEEP 12288:INGG3U3ITEmUbqLEL2br8IsTxzbYN6uiqzV6lyTgruIsd7V77Y:2AIAmUbqoyboIhN6uzV6Ygre58
TLSH
T1C4F4E115EAA814F9E173C17CC9634605EA727C9A47B0DBCF23A449962F33AD09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

C:\Users\Admin\AppData\Local\Temp\2026-06-08_9a5e60780f1b8929d652403b20c61fa1_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-08_9a5e60780f1b8929d652403b20c61fa1_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
PID:836