General
- Target 2026-07-18_196a5ed9054b54338f262b2ca6d2ce6a_cobalt-strike_icedid_njrat_satacom_stealc
- Size 526KB
- Sample260718-blke3abv8j
- SHA256 ddfc84f0f6e244404a12f23af562abce42151a369bba41bf8d1695699400cccc
- MD5 196a5ed9054b54338f262b2ca6d2ce6a
- SHA1 219e0ab2b04f8c5e2230fc8c3cf67a15dd51cc7d
- SHA512 ac62b1d026f87eb553e6b40515bccd07bacb401f12cc147c99d2055329bb70d0b41b4dec2ab1de7068dc174a1bba4beb0ea137ccb80b3b9c4803ca4418f64e7d
- SSDEEP 6144:lIcXHtLYbVdzU6tlWyo3YTeHWeuEoGdQcDPjEnNl++rXFR3tHWVn5fENrQVbAq:lVdcZ0joKvvVDwNl++ZxtHWVdENrQR
- TLSH T12FB4DF54E7B914F9E577D17CCD924902EA72BC060770AACF23A046962F237E09E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-18_196a5ed9054b54338f262b2ca6d2ce6a_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_196a5ed9054b54338f262b2ca6d2ce6a_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-18_196a5ed9054b54338f262b2ca6d2ce6a_cobalt-strike_icedid_njrat_satacom_stealc
- Size 526KB
- SHA256 ddfc84f0f6e244404a12f23af562abce42151a369bba41bf8d1695699400cccc
- MD5 196a5ed9054b54338f262b2ca6d2ce6a
- SHA1 219e0ab2b04f8c5e2230fc8c3cf67a15dd51cc7d
- SHA512 ac62b1d026f87eb553e6b40515bccd07bacb401f12cc147c99d2055329bb70d0b41b4dec2ab1de7068dc174a1bba4beb0ea137ccb80b3b9c4803ca4418f64e7d
- SSDEEP 6144:lIcXHtLYbVdzU6tlWyo3YTeHWeuEoGdQcDPjEnNl++rXFR3tHWVn5fENrQVbAq:lVdcZ0joKvvVDwNl++ZxtHWVdENrQR
- TLSH T12FB4DF54E7B914F9E577D17CCD924902EA72BC060770AACF23A046962F237E09E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.