1d238d25fb50b7adc38ceb4c9a611d64107a116781ae9e3fca3278d71ee40136

Analysis

max time kernel
150s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 01:27

Target
2026-07-10_0cc0d48e38835f9a137985c5879a5fe2_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 701KB
Sample260710-bvma1scz21
SHA256 1d238d25fb50b7adc38ceb4c9a611d64107a116781ae9e3fca3278d71ee40136
MD5 0cc0d48e38835f9a137985c5879a5fe2
SHA1 5dc19d72a8790364e909ceb506e58bf6502993cf
SHA512 e0eceebec2334fd9fde327da40da1d1fd638eb8b8334bf028f0bc353ba739aa0657e4410fc514e69fa2eac301399ca752c6e105b0555e72802d754032abd557e
SSDEEP 12288:ZNGG3U3ITEmUbqLEL27H3L11ig/BmZ2MRnK1gLAADL8:JAIAmUbqoi6gZw2+K1dwI
TLSH
T1DAE4E115EBA414F9E277C17CCD634A01EA72BC9A0760E7CF13A489962F276D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

C:\Users\Admin\AppData\Local\Temp\2026-07-10_0cc0d48e38835f9a137985c5879a5fe2_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_0cc0d48e38835f9a137985c5879a5fe2_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
PID:3132