General
- Target 2026-07-18_13276625c19c9e77612c7acd4b8532cf_cobalt-strike_icedid_njrat_satacom_stealc
- Size 721KB
- Sample260718-blw4vsbv9l
- SHA256 b55f271a2f343011c049b24c2ebe1ab96c8f9a1a34982caaad833f5d033bed9a
- MD5 13276625c19c9e77612c7acd4b8532cf
- SHA1 09beba7f8b6fce268c99f778f0532393c35ea59b
- SHA512 45ef454d2b1583cfeb96e7abb3dff627ee8a31d01634d54607de529371a5e7b925929e11c3b06075a5d54de7d78bd5b6cf352782b8754d983711248845bb25c4
- SSDEEP 12288:iVdcZ0joK+vVZL31xx1b7Fnr8RrO9SEepRBJFVf8FZ+2:UdG08Nv1x3fBwRrF/zQK2
- TLSH T1FCF4F154E3A514FAE177D17CCD925506EA72BC464770A6CF23A006A32F23BE49E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-18_13276625c19c9e77612c7acd4b8532cf_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_13276625c19c9e77612c7acd4b8532cf_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260710-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-18_13276625c19c9e77612c7acd4b8532cf_cobalt-strike_icedid_njrat_satacom_stealc
- Size 721KB
- SHA256 b55f271a2f343011c049b24c2ebe1ab96c8f9a1a34982caaad833f5d033bed9a
- MD5 13276625c19c9e77612c7acd4b8532cf
- SHA1 09beba7f8b6fce268c99f778f0532393c35ea59b
- SHA512 45ef454d2b1583cfeb96e7abb3dff627ee8a31d01634d54607de529371a5e7b925929e11c3b06075a5d54de7d78bd5b6cf352782b8754d983711248845bb25c4
- SSDEEP 12288:iVdcZ0joK+vVZL31xx1b7Fnr8RrO9SEepRBJFVf8FZ+2:UdG08Nv1x3fBwRrF/zQK2
- TLSH T1FCF4F154E3A514FAE177D17CCD925506EA72BC464770A6CF23A006A32F23BE49E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.