Extracted

Extracted

Extracted

• • Target
    2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc
  • Size 1.1MB
  • SHA256 debf8d12b485bb8872dd40ad424e0f23ca254c56f5aa335d9a20bf618f9c8969
  • MD5 0c273b22168a2610fc95af914b33c8cd
  • SHA1 cacf9c538b34779431ea54764d89f96489feed79
  • SHA512 cd197cc20a2078226876cde0ea5fb091cc1f1c933d50bf5626fd51c39319d8b02032fdffc66364a58abac6739eb82bdd4b105013c7c0b67f7f49121dd1f418c2
  • SSDEEP 12288:4DtRRdC4rGDHNEkkvaXs3HOD/5y2V7/WmGdctZpFiDjeats8MwWPAcI45s/Mu:XHNTkCXm2VqmGdcjp7d8MwWvI45m
  • TLSH
    T104451901A6E402A8E1B7D774DE7B5845E777B94A0730E9DF0294955F0F339888A3EB32
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionspywarestealerupx

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Custom signature

    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Custom signature

    UPX dump on OEP (original entry point)

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2