General
- Target 2026-07-20_e0db1a4df7cf0100ec5cc5b5c27bd0bc_cobalt-strike_icedid_njrat_satacom_stealc
- Size 540KB
- Sample260720-cydcyscw4m
- SHA256 3a56ac25137f124766fb8d94042b23eec821607fb3d2efab9d5c6f47418dc0c0
- MD5 e0db1a4df7cf0100ec5cc5b5c27bd0bc
- SHA1 a593cdd5961170222e3a8663ad3cf823775cb02a
- SHA512 66df8f03602edcdca31d7b7bed799c4f191253d929096a9a0f22c2008360f4b8236d81956514879c84badfcd4e8e2fff09a5788fb31995d08215f59313bb1c54
- SSDEEP 12288:8VdcZ0joKcvVjkwOC8G/ZQ5C75wGfZhlo:+dG08HdOC815CeGfa
- TLSH T137C4CF55E3A914F9E177D17CCD924502EA72BC464770AACF23A006972F237E09E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_e0db1a4df7cf0100ec5cc5b5c27bd0bc_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_e0db1a4df7cf0100ec5cc5b5c27bd0bc_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_e0db1a4df7cf0100ec5cc5b5c27bd0bc_cobalt-strike_icedid_njrat_satacom_stealc
- Size 540KB
- SHA256 3a56ac25137f124766fb8d94042b23eec821607fb3d2efab9d5c6f47418dc0c0
- MD5 e0db1a4df7cf0100ec5cc5b5c27bd0bc
- SHA1 a593cdd5961170222e3a8663ad3cf823775cb02a
- SHA512 66df8f03602edcdca31d7b7bed799c4f191253d929096a9a0f22c2008360f4b8236d81956514879c84badfcd4e8e2fff09a5788fb31995d08215f59313bb1c54
- SSDEEP 12288:8VdcZ0joKcvVjkwOC8G/ZQ5C75wGfZhlo:+dG08HdOC815CeGfa
- TLSH T137C4CF55E3A914F9E177D17CCD924502EA72BC464770AACF23A006972F237E09E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.