General
- Target 2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc
- Size 8.4MB
- Sample260703-pm82psd14j
- SHA256 03eab1406d7d4d4505971c4e3b73b6cd81bedbd95a109869fd955510781d26c7
- MD5 8a37981d3d0d3118374a8f2917f74792
- SHA1 ffed95cf4cb4a0f8cda964e1abaf05aff2d695c6
- SHA512 ad942c1546ee4093ead9b9d63205a158aa046a376b10b11611c4f6b812f6078a3118836709425d40601aa8156e24910c6fc0805fddfed859c06e239bce3dcd61
- SSDEEP 98304:Af9Gzj+72yN/3O3rI7jxXyzP792k6SQsP1g:8Tqw/QKj9yzP7Qy1
- TLSH T1AF969E866B14CDD2F94040B1B8D14D1C7BA34B26CA95C4F6A0A189C19EE19FB7EBF17C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260629-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-03_8a37981d3d0d3118374a8f2917f74792_cobalt-strike_icedid_njrat_satacom_stealc
- Size 8.4MB
- SHA256 03eab1406d7d4d4505971c4e3b73b6cd81bedbd95a109869fd955510781d26c7
- MD5 8a37981d3d0d3118374a8f2917f74792
- SHA1 ffed95cf4cb4a0f8cda964e1abaf05aff2d695c6
- SHA512 ad942c1546ee4093ead9b9d63205a158aa046a376b10b11611c4f6b812f6078a3118836709425d40601aa8156e24910c6fc0805fddfed859c06e239bce3dcd61
- SSDEEP 98304:Af9Gzj+72yN/3O3rI7jxXyzP792k6SQsP1g:8Tqw/QKj9yzP7Qy1
- TLSH T1AF969E866B14CDD2F94040B1B8D14D1C7BA34B26CA95C4F6A0A189C19EE19FB7EBF17C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger