General
- Target 2026-06-28_c858d6021d311d65a759d1b8cc198d6e_cobalt-strike_icedid_njrat_satacom_stealc
- Size 1.6MB
- Sample260628-xt97cab18x
- SHA256 d5d4e505d5252adf97d3f00ab37001dcd59845daf979f6590f5566036503ed8c
- MD5 c858d6021d311d65a759d1b8cc198d6e
- SHA1 6abb72b699fda42c2fdbcfed6c46cbd53b6665ca
- SHA512 9acc78295d08e1957f80cae93c6f4cfa5c6751598e07e9caa62423bf65162be42a99ebdefee0439c5ceca37b7e59272a6fdb9fc822b58412b289c2029e7dcf58
- SSDEEP 24576:21QI67KScbbRIbrDAm1XmhjX5IsogsX+D+DOxW4n3nsKZ+aIuN:kQ/7KLJIbrDdIT5xlnMuN
- TLSH T1EE85AE05B2A442E8C17A95788886D63AEB327C151F2096CF23F05E673F676E05F7B391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-28_c858d6021d311d65a759d1b8cc198d6e_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_c858d6021d311d65a759d1b8cc198d6e_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260618-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-06-28_c858d6021d311d65a759d1b8cc198d6e_cobalt-strike_icedid_njrat_satacom_stealc
- Size 1.6MB
- SHA256 d5d4e505d5252adf97d3f00ab37001dcd59845daf979f6590f5566036503ed8c
- MD5 c858d6021d311d65a759d1b8cc198d6e
- SHA1 6abb72b699fda42c2fdbcfed6c46cbd53b6665ca
- SHA512 9acc78295d08e1957f80cae93c6f4cfa5c6751598e07e9caa62423bf65162be42a99ebdefee0439c5ceca37b7e59272a6fdb9fc822b58412b289c2029e7dcf58
- SSDEEP 24576:21QI67KScbbRIbrDAm1XmhjX5IsogsX+D+DOxW4n3nsKZ+aIuN:kQ/7KLJIbrDdIT5xlnMuN
- TLSH T1EE85AE05B2A442E8C17A95788886D63AEB327C151F2096CF23F05E673F676E05F7B391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information as a root user.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.