General
- Target 2026-07-18_361ba808fc00b68f91b9728d1514fc0a_cobalt-strike_icedid_njrat_satacom_stealc
- Size 459KB
- Sample260718-npklfsh13m
- SHA256 98ba301528ee4b33394dbae5104302a0f8d738a621ab9bd14220828f42b429a0
- MD5 361ba808fc00b68f91b9728d1514fc0a
- SHA1 a5874e572bc1d547e10e31447869795f8e477c26
- SHA512 5c3cd6746ddffed10acf45425b281a85d3be42472b583cd38c62ad0b412e6a48fefa07e0830d1e9ec0a17935721e31747afa99e2f875a075d37d1d1b5db94ce7
- SSDEEP 6144:1IcXHtLYbVdzU6tlWyo3YTeHWWuEoGdzhHChqqw2+mVLRy5ZL6In9jY:1VdcZ0joKrvVdHM+mVLRYL6In9jY
- TLSH T1BCA4BF15E3B914F9E577C17CCD924502EA72BC464770AACF23A046962F237E09E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-18_361ba808fc00b68f91b9728d1514fc0a_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_361ba808fc00b68f91b9728d1514fc0a_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-18_361ba808fc00b68f91b9728d1514fc0a_cobalt-strike_icedid_njrat_satacom_stealc
- Size 459KB
- SHA256 98ba301528ee4b33394dbae5104302a0f8d738a621ab9bd14220828f42b429a0
- MD5 361ba808fc00b68f91b9728d1514fc0a
- SHA1 a5874e572bc1d547e10e31447869795f8e477c26
- SHA512 5c3cd6746ddffed10acf45425b281a85d3be42472b583cd38c62ad0b412e6a48fefa07e0830d1e9ec0a17935721e31747afa99e2f875a075d37d1d1b5db94ce7
- SSDEEP 6144:1IcXHtLYbVdzU6tlWyo3YTeHWWuEoGdzhHChqqw2+mVLRy5ZL6In9jY:1VdcZ0joKrvVdHM+mVLRYL6In9jY
- TLSH T1BCA4BF15E3B914F9E577C17CCD924502EA72BC464770AACF23A046962F237E09E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.