General
- Target 2026-07-20_e0ffcfb4a2bffb4619db2994f57ec09c_cobalt-strike_icedid_njrat_satacom_stealc
- Size 335KB
- Sample260720-m8xjpafy7q
- SHA256 6f89821debf957ec62685944f827c110e73dacb1e7979dbec82d971dbb979d22
- MD5 e0ffcfb4a2bffb4619db2994f57ec09c
- SHA1 523da2298cfc471a9be782efa5c1867e470ef533
- SHA512 c1bca9b015f710ad04dc302c2c17f16962995def62cd12b3fb373036d063fcdc1bfcc6b06cc9dca1e31738c42526a14fc179802724b6a387449e3578fa62b7fd
- SSDEEP 6144:wIcXHtLYbVdzU6tlWyo3YTeHWVuEoGdkNXnhPAo:wVdcZ0joKgvV+nBAo
- TLSH T1CF748D15E3A514F9E577C17CCD924902EA72BC464770AACF23A046972F237E09E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_e0ffcfb4a2bffb4619db2994f57ec09c_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_e0ffcfb4a2bffb4619db2994f57ec09c_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-20_e0ffcfb4a2bffb4619db2994f57ec09c_cobalt-strike_icedid_njrat_satacom_stealc
- Size 335KB
- SHA256 6f89821debf957ec62685944f827c110e73dacb1e7979dbec82d971dbb979d22
- MD5 e0ffcfb4a2bffb4619db2994f57ec09c
- SHA1 523da2298cfc471a9be782efa5c1867e470ef533
- SHA512 c1bca9b015f710ad04dc302c2c17f16962995def62cd12b3fb373036d063fcdc1bfcc6b06cc9dca1e31738c42526a14fc179802724b6a387449e3578fa62b7fd
- SSDEEP 6144:wIcXHtLYbVdzU6tlWyo3YTeHWVuEoGdkNXnhPAo:wVdcZ0joKgvV+nBAo
- TLSH T1CF748D15E3A514F9E577C17CCD924902EA72BC464770AACF23A046972F237E09E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.