Extracted

Extracted

Extracted

• • Target
    2026-07-07_4e15a088abc22438bb6d943b778184ea_cobalt-strike_icedid_njrat_satacom_stealc
  • Size 1.1MB
  • SHA256 a9af1fd5f773799bec1e0be8dcf57285c7dbac403763efbf1e119c1e85e9829d
  • MD5 4e15a088abc22438bb6d943b778184ea
  • SHA1 d98938c4d51435a8ce380ba9b86a78803f09f7f5
  • SHA512 d0e3a511051abb5b44274c5b5be746f583d7df16577a7e6cd78b82522f2cb3855708f9e1ad2f6fdb80b94ab0dadb1dbb7336833d6128df9dacadebf94dd62832
  • SSDEEP 12288:D66/+0tgZTblFTKE9DVnVsJytnZrvNZ95Wulo5SlQE7VIxnuGqTIijvDLBoW:KnfTKMDSyHT95LlHld4uGqtvXB
  • TLSH
    T1FF352901A6E402A8E1B7D3B4DE775846E77779460735E9DF0284A55F0F339888A3EB32
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionspywarestealerupx

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Custom signature

    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Custom signature

    UPX dump on OEP (original entry point)

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2