General
- Target 2026-07-21_6f821498a8313d6c62612c1a0bf052be_cobalt-strike_icedid_njrat_satacom_stealc
- Size 16.8MB
- Sample260721-1l7yssvbmd
- SHA256 5ae811a06c8590226c2a2c4f1fd6d66fb0ba1ec547528495939af547ce42d555
- MD5 6f821498a8313d6c62612c1a0bf052be
- SHA1 a2cf838795d75ae6e0f538c8f17ef49b9fc3ee5d
- SHA512 357859d8c28971ce208e3b74b45a4703c26917168de18bcf266614d064629c48515bbe0e4f41ed7a7f6291b4370e906c318138e5bce6c3f7327b12b99b3a8895
- SSDEEP 393216:cGdcptVS2I92h7AQJiN/5dcptVS2I92h7AQJOR:Fd2tV5I9dYg5d2tV5I9dYO
- TLSH T1B007221572F810ACF0769134C5AA661BD7727C6617319ADF13E4096A2F37BF00ABB722
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-21_6f821498a8313d6c62612c1a0bf052be_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-21_6f821498a8313d6c62612c1a0bf052be_cobalt-strike_icedid_njrat_satacom_stealc
- Size 16.8MB
- SHA256 5ae811a06c8590226c2a2c4f1fd6d66fb0ba1ec547528495939af547ce42d555
- MD5 6f821498a8313d6c62612c1a0bf052be
- SHA1 a2cf838795d75ae6e0f538c8f17ef49b9fc3ee5d
- SHA512 357859d8c28971ce208e3b74b45a4703c26917168de18bcf266614d064629c48515bbe0e4f41ed7a7f6291b4370e906c318138e5bce6c3f7327b12b99b3a8895
- SSDEEP 393216:cGdcptVS2I92h7AQJiN/5dcptVS2I92h7AQJOR:Fd2tV5I9dYg5d2tV5I9dYO
- TLSH T1B007221572F810ACF0769134C5AA661BD7727C6617319ADF13E4096A2F37BF00ABB722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)