General
- Target 2026-07-20_f4548c6b3ac80e080419e9be58519a03_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.9MB
- Sample260720-ct4pcacv5k
- SHA256 8e0db05d8f382374c5cfccc420b62bf5c34deb636da3d05b7fc68bf997a90df3
- MD5 f4548c6b3ac80e080419e9be58519a03
- SHA1 f505eb0d050d67a14110429c976a84ac331ca305
- SHA512 52e4db9e11ef812f0cb9efd735e165f7eca1b5814c8e73aef3981b7e63de3a3b14950d18f122f2b9b480fdefe45f0bad28124b8b9e48dd892c68bb59094a890d
- SSDEEP 24576:ivG23pMEaIhHNtgPlDR3B7hsg8wwLP4LuoEfsCv8itjcdEnBsTfT0nKrLRsi/N+s:iOAMEBHNZtcISLnJFA
- TLSH T119E5F84BEAB690D0D4FAD139D652A62BFC713C5DC235A7539B818B174B62B70E93E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
8 signatures
Behavioral task
behavioral1
Sample
2026-07-20_f4548c6b3ac80e080419e9be58519a03_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_f4548c6b3ac80e080419e9be58519a03_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_f4548c6b3ac80e080419e9be58519a03_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.9MB
- SHA256 8e0db05d8f382374c5cfccc420b62bf5c34deb636da3d05b7fc68bf997a90df3
- MD5 f4548c6b3ac80e080419e9be58519a03
- SHA1 f505eb0d050d67a14110429c976a84ac331ca305
- SHA512 52e4db9e11ef812f0cb9efd735e165f7eca1b5814c8e73aef3981b7e63de3a3b14950d18f122f2b9b480fdefe45f0bad28124b8b9e48dd892c68bb59094a890d
- SSDEEP 24576:ivG23pMEaIhHNtgPlDR3B7hsg8wwLP4LuoEfsCv8itjcdEnBsTfT0nKrLRsi/N+s:iOAMEBHNZtcISLnJFA
- TLSH T119E5F84BEAB690D0D4FAD139D652A62BFC713C5DC235A7539B818B174B62B70E93E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.