db51677e579c29e8d37e302101bcf9a2e91414bcd94d079afb75b0d6170bff22

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 20:43

Target
2026-07-20_13bc73d007799dc13d93cb03b5ed96dc_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 521KB
Sample260720-zh2ryaev4p
SHA256 db51677e579c29e8d37e302101bcf9a2e91414bcd94d079afb75b0d6170bff22
MD5 13bc73d007799dc13d93cb03b5ed96dc
SHA1 b1d8132911fb734bb2cc4fb36f0b009fc43424b8
SHA512 2c730366279f680f0ffb925a4b16c32f582587209f9bb4ce4d26aef55317932db73c6d5668ac797dab2b15543e8ae2aa3ff4a4dce78d1847e4c82a0094d6b3ee
SSDEEP 12288:KNGG3U3ITEmUbqLEL0xghDi237Jp4RFAfhBq:UAIAmUbqooxr2Fp4RFYG
TLSH
T1ABB4C055FBA814F9E273813CCD634602EA727C9A0760E7DB13A489962F336D19E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

C:\Users\Admin\AppData\Local\Temp\2026-07-20_13bc73d007799dc13d93cb03b5ed96dc_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_13bc73d007799dc13d93cb03b5ed96dc_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
PID:1052