General
- Target 2026-07-16_b1bf781b3ece7b21640fba6fd90bbfba_cobalt-strike_coinminer_icedid_njrat_satacom_stealc
- Size 586KB
- Sample260716-2atgpsfs4k
- SHA256 12cee1280263b692aee405570762095968b142d6561e3f45a8f9f2e8fa032efd
- MD5 b1bf781b3ece7b21640fba6fd90bbfba
- SHA1 d5d2805ed475bacfc8ed5cc944bb490627ee5eba
- SHA512 b7885fce9d9eb5ec39517f9abe63bb4d4837a22d4e434099fb252e1d563dba1fe48707f6a1274667a808bc8315ebb7783de0f06109ad5660e16bb1cb808be926
- SSDEEP 12288:Z4Ly75o0aCpnNjTVjGTMJ1PDznIncmKkgLyz:+tiHjJ4UrzQcKgO
- TLSH T11CD46B69A7A500F9D1B6C578CE934523FA7278058371AADF13D08A671F236E09F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-16_b1bf781b3ece7b21640fba6fd90bbfba_cobalt-strike_coinminer_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_b1bf781b3ece7b21640fba6fd90bbfba_cobalt-strike_coinminer_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260710-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-16_b1bf781b3ece7b21640fba6fd90bbfba_cobalt-strike_coinminer_icedid_njrat_satacom_stealc
- Size 586KB
- SHA256 12cee1280263b692aee405570762095968b142d6561e3f45a8f9f2e8fa032efd
- MD5 b1bf781b3ece7b21640fba6fd90bbfba
- SHA1 d5d2805ed475bacfc8ed5cc944bb490627ee5eba
- SHA512 b7885fce9d9eb5ec39517f9abe63bb4d4837a22d4e434099fb252e1d563dba1fe48707f6a1274667a808bc8315ebb7783de0f06109ad5660e16bb1cb808be926
- SSDEEP 12288:Z4Ly75o0aCpnNjTVjGTMJ1PDznIncmKkgLyz:+tiHjJ4UrzQcKgO
- TLSH T11CD46B69A7A500F9D1B6C578CE934523FA7278058371AADF13D08A671F236E09F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext