General
- Target 2026-07-31_cfc2af792d1c8617d0e89689c372478f_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.7MB
- Sample260731-bq26nsaf22
- SHA256 dd3ca5a6e64cf3760b6632fa62fa61d246ca31f7579ba82f8bb26622aefe4aef
- MD5 cfc2af792d1c8617d0e89689c372478f
- SHA1 18f216fa202284f2264a9eb6e975cdcd5bb56cfb
- SHA512 1f3f1e3f79d011ed138436302efe8f96b4f373a645dc2d4183875d50bfe765f26e99962119cd61d223c8118b169bf09a1662b5fbb211f897570011707e8674ed
- SSDEEP 24576:wItHMGbSJfeHMeYX3B6h3Dm8wwLP4LuoEfnZYq1bhxuJsXv3Cl3nbsUQiCwQd0Bt:wKHMGbbH1ra/ztBq
- TLSH T164D5E847EAB690D0D4FAD139C652A62BFD713C5DC234A7579B81DB174B62BA0E83E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
7 signatures
Behavioral task
behavioral1
Sample
2026-07-31_cfc2af792d1c8617d0e89689c372478f_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_cfc2af792d1c8617d0e89689c372478f_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_cfc2af792d1c8617d0e89689c372478f_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.7MB
- SHA256 dd3ca5a6e64cf3760b6632fa62fa61d246ca31f7579ba82f8bb26622aefe4aef
- MD5 cfc2af792d1c8617d0e89689c372478f
- SHA1 18f216fa202284f2264a9eb6e975cdcd5bb56cfb
- SHA512 1f3f1e3f79d011ed138436302efe8f96b4f373a645dc2d4183875d50bfe765f26e99962119cd61d223c8118b169bf09a1662b5fbb211f897570011707e8674ed
- SSDEEP 24576:wItHMGbSJfeHMeYX3B6h3Dm8wwLP4LuoEfnZYq1bhxuJsXv3Cl3nbsUQiCwQd0Bt:wKHMGbbH1ra/ztBq
- TLSH T164D5E847EAB690D0D4FAD139C652A62BFD713C5DC234A7579B81DB174B62BA0E83E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.