General
- Target 2026-07-29_eae3b659f3144194b59f37c7c49c6a4d_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.7MB
- Sample260729-mga7daff86
- SHA256 5afc0984e9f19138ec07924e0d92428ac9a7b752e43f28363d13bbd72b317344
- MD5 eae3b659f3144194b59f37c7c49c6a4d
- SHA1 9cbd142b2ef6e1339119e855bccce0a217602022
- SHA512 9d2471ebb3ab632b4eb6af35b27e31687dcaf1f6627d855ea35300ee9cda222753c59edb98f81e8c03b4baee5c14b20044df8f9c89f654a433eda2dd3e20b755
- SSDEEP 24576:OBLumMMybcJznHIEVm3BOhNA8wwLP4LuoEf27kHmHd6AUUa3sghsZSafux9iCbnM:OBTMMyb4HfVAoXEf
- TLSH T150D5D74BEAB690E0D4FAD139C252A62BFD713C5DC234A7579B41DB174B62B60E93E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
7 signatures
Behavioral task
behavioral1
Sample
2026-07-29_eae3b659f3144194b59f37c7c49c6a4d_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_eae3b659f3144194b59f37c7c49c6a4d_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-29_eae3b659f3144194b59f37c7c49c6a4d_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.7MB
- SHA256 5afc0984e9f19138ec07924e0d92428ac9a7b752e43f28363d13bbd72b317344
- MD5 eae3b659f3144194b59f37c7c49c6a4d
- SHA1 9cbd142b2ef6e1339119e855bccce0a217602022
- SHA512 9d2471ebb3ab632b4eb6af35b27e31687dcaf1f6627d855ea35300ee9cda222753c59edb98f81e8c03b4baee5c14b20044df8f9c89f654a433eda2dd3e20b755
- SSDEEP 24576:OBLumMMybcJznHIEVm3BOhNA8wwLP4LuoEf27kHmHd6AUUa3sghsZSafux9iCbnM:OBTMMyb4HfVAoXEf
- TLSH T150D5D74BEAB690E0D4FAD139C252A62BFD713C5DC234A7579B41DB174B62B60E93E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.