General
- Target 2026-07-03_5e89727eeed8a54bc678c40cd206831a_cobalt-strike_icedid_njrat_satacom_stealc
- Size 785KB
- Sample260703-ththnsht5k
- SHA256 af7b41dd7df1cd79d549e4b79425647f89b552f0b6eca809e57cd573541cbc76
- MD5 5e89727eeed8a54bc678c40cd206831a
- SHA1 53e871ee3d8d3701dcdf2cf2c0af029b2a55c3f5
- SHA512 ea5f1b28ae368c82d50e8ea1e0533110b4f89d21277dd93c5980e07fc65f5dc31f77a5fc41631d9d160c5f1fd6c382bf78a6d5f771d6b8f22c90c9e4c2a5b5b9
- SSDEEP 12288:GNGG3U3ITEmUbqLEL9Rw6dIHfnlMHE1co0ly0NqdXtNesTQFpA:wAIAmUbqoZRwYIHvlRddN3TwK
- TLSH T11405E115FBA814F9E177C17CC9634602EA727C5A4760ABCF13A48A962F376D08E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-03_5e89727eeed8a54bc678c40cd206831a_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_5e89727eeed8a54bc678c40cd206831a_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260630-en
1 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-03_5e89727eeed8a54bc678c40cd206831a_cobalt-strike_icedid_njrat_satacom_stealc
- Size 785KB
- SHA256 af7b41dd7df1cd79d549e4b79425647f89b552f0b6eca809e57cd573541cbc76
- MD5 5e89727eeed8a54bc678c40cd206831a
- SHA1 53e871ee3d8d3701dcdf2cf2c0af029b2a55c3f5
- SHA512 ea5f1b28ae368c82d50e8ea1e0533110b4f89d21277dd93c5980e07fc65f5dc31f77a5fc41631d9d160c5f1fd6c382bf78a6d5f771d6b8f22c90c9e4c2a5b5b9
- SSDEEP 12288:GNGG3U3ITEmUbqLEL9Rw6dIHfnlMHE1co0ly0NqdXtNesTQFpA:wAIAmUbqoZRwYIHvlRddN3TwK
- TLSH T11405E115FBA814F9E177C17CC9634602EA727C5A4760ABCF13A48A962F376D08E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1