General
- Target 2026-07-31_e370abb696b687c190b81d7c26b7fd74_cobalt-strike_icedid_njrat_satacom_stealc
- Size 267KB
- Sample260731-bqsl8stwcs
- SHA256 fd94b669ad761786bc2c5811f6c10afb655ff0b39f41c73fb5d433ea7a5690f1
- MD5 e370abb696b687c190b81d7c26b7fd74
- SHA1 c2382830ae07b3daaf3230d48a4da38d9cd4db99
- SHA512 fb78af20487e9f923a129c6671adac380c4a33927003421a585d80f3016cdc7d4dc490330550f27bcdd3de0664067b755ebbcc4075e8e79eaa2f0507366d4ec4
- SSDEEP 3072:sYJN7cO0v5QvtBT5BN9XQqBjrxkZyz0AAg61mpu3XoE0GTWSAPqhhBBXBGoZM43a:ssNYNBQvbpZQcaUYAU5X0wyEGf3L
- TLSH T1B3446C29AA6508FDE967D57DCA524902EB727C460370EADF03A00DA31F176E49E3FB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-31_e370abb696b687c190b81d7c26b7fd74_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_e370abb696b687c190b81d7c26b7fd74_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-31_e370abb696b687c190b81d7c26b7fd74_cobalt-strike_icedid_njrat_satacom_stealc
- Size 267KB
- SHA256 fd94b669ad761786bc2c5811f6c10afb655ff0b39f41c73fb5d433ea7a5690f1
- MD5 e370abb696b687c190b81d7c26b7fd74
- SHA1 c2382830ae07b3daaf3230d48a4da38d9cd4db99
- SHA512 fb78af20487e9f923a129c6671adac380c4a33927003421a585d80f3016cdc7d4dc490330550f27bcdd3de0664067b755ebbcc4075e8e79eaa2f0507366d4ec4
- SSDEEP 3072:sYJN7cO0v5QvtBT5BN9XQqBjrxkZyz0AAg61mpu3XoE0GTWSAPqhhBBXBGoZM43a:ssNYNBQvbpZQcaUYAU5X0wyEGf3L
- TLSH T1B3446C29AA6508FDE967D57DCA524902EB727C460370EADF03A00DA31F176E49E3FB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.