General
- Target 2026-07-12_d90c9caf45a4964574c1343a98eed3ec_avaddon_cobalt-strike_icedid_njrat_satacom_stealc
- Size 1.7MB
- Sample260712-j63fdagw2t
- SHA256 4119cea3d97ec8c4f4f6c5240938bb8e218916fcc1be07fd53e79c5394ac8419
- MD5 d90c9caf45a4964574c1343a98eed3ec
- SHA1 95a9b81c52eca266ea21cd65935ae881a5ae5943
- SHA512 947b8ce6c317dbfabe2a22972bf8a6ae2e36542841b8f47c8559680535044f3afa6afe0f94db218441c50126a62ebfcbce7a4368181b8bae88daebc7f663ba13
- SSDEEP 24576:0uCkNmchHIqdw/xt8wbgtkmzbxQyFaHqVMy973f2dKhlGvTc4J:TtNNHIqu5tbgeQbxHFaKCyfvGv5
- TLSH T1A8857D17A37400EDD1A7C1B8CA165607EB72744A1334AADF13D09AA62F23AE55F7F720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-12_d90c9caf45a4964574c1343a98eed3ec_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_d90c9caf45a4964574c1343a98eed3ec_avaddon_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-12_d90c9caf45a4964574c1343a98eed3ec_avaddon_cobalt-strike_icedid_njrat_satacom_stealc
- Size 1.7MB
- SHA256 4119cea3d97ec8c4f4f6c5240938bb8e218916fcc1be07fd53e79c5394ac8419
- MD5 d90c9caf45a4964574c1343a98eed3ec
- SHA1 95a9b81c52eca266ea21cd65935ae881a5ae5943
- SHA512 947b8ce6c317dbfabe2a22972bf8a6ae2e36542841b8f47c8559680535044f3afa6afe0f94db218441c50126a62ebfcbce7a4368181b8bae88daebc7f663ba13
- SSDEEP 24576:0uCkNmchHIqdw/xt8wbgtkmzbxQyFaHqVMy973f2dKhlGvTc4J:TtNNHIqu5tbgeQbxHFaKCyfvGv5
- TLSH T1A8857D17A37400EDD1A7C1B8CA165607EB72744A1334AADF13D09AA62F23AE55F7F720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key