General
- Target 2026-07-27_2933cb478c00110a3973722e36f4a2f7_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.7MB
- Sample260727-1pbd1aep4y
- SHA256 98ca2e5071bbe72fd3e06e5be42247ff8e91920b185d33a131a8b9efca859eb2
- MD5 2933cb478c00110a3973722e36f4a2f7
- SHA1 25416d6ca26e5772e04d394a614825ec2d0b25ff
- SHA512 1fa0e4a2433a6f6700f134d0989ab13a2bd785230183d3d77db379e0b02ca4c3c6571310558a4ec2ffe7c9b46eedc5e80fe5b8dcd20bdc7f57cca84b9ea63b24
- SSDEEP 24576:3ns6so6tM9bsJ1jHjj4PN03Blh/U8wwLP4LuoEf90Cxf6Gp3Bsg5kpdPxRFIiC7G:3ns6b6tM9b6HjqcAx9bQR6O
- TLSH T127D5E847EAB690E0D4FAD139C652A62BFD713C5DC234A7579B81DB174B62BA0D83E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
7 signatures
Behavioral task
behavioral1
Sample
2026-07-27_2933cb478c00110a3973722e36f4a2f7_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_2933cb478c00110a3973722e36f4a2f7_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260710-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-27_2933cb478c00110a3973722e36f4a2f7_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.7MB
- SHA256 98ca2e5071bbe72fd3e06e5be42247ff8e91920b185d33a131a8b9efca859eb2
- MD5 2933cb478c00110a3973722e36f4a2f7
- SHA1 25416d6ca26e5772e04d394a614825ec2d0b25ff
- SHA512 1fa0e4a2433a6f6700f134d0989ab13a2bd785230183d3d77db379e0b02ca4c3c6571310558a4ec2ffe7c9b46eedc5e80fe5b8dcd20bdc7f57cca84b9ea63b24
- SSDEEP 24576:3ns6so6tM9bsJ1jHjj4PN03Blh/U8wwLP4LuoEf90Cxf6Gp3Bsg5kpdPxRFIiC7G:3ns6b6tM9b6HjqcAx9bQR6O
- TLSH T127D5E847EAB690E0D4FAD139C652A62BFD713C5DC234A7579B81DB174B62BA0D83E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.