General
- Target 2026-08-01_f5e0c48a856348d08df464764f9c70fb_cobalt-strike_icedid_njrat_satacom_stealc
- Size 815KB
- Sample260801-cv1dbacb93
- SHA256 6b6249ed01704138c060d785110a650121b003c83b240bd43e02d37db441b84c
- MD5 f5e0c48a856348d08df464764f9c70fb
- SHA1 79b5de3f8fb906da843c4b8569a61d8e1a9b5113
- SHA512 2f8aeb3d38edfd3f165fe86381f42154c877f741a87e8b9e88c779bf4802431c405e6609eaaf690a417930ff7887a99a8dc9b76fd1fa0711954a14af391b624c
- SSDEEP 12288:+ZGWOIehwmZ2/XM14Tjs+Bchv8fy8iKQpsz/v+JWnBo44E:PmwTZ2fbIkfyQQpsz+WnBT
- TLSH T17E059E59F2E800EEE077E538D5616A17E93278560F30AADF13D005697F336E44A7BB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_f5e0c48a856348d08df464764f9c70fb_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_f5e0c48a856348d08df464764f9c70fb_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_f5e0c48a856348d08df464764f9c70fb_cobalt-strike_icedid_njrat_satacom_stealc
- Size 815KB
- SHA256 6b6249ed01704138c060d785110a650121b003c83b240bd43e02d37db441b84c
- MD5 f5e0c48a856348d08df464764f9c70fb
- SHA1 79b5de3f8fb906da843c4b8569a61d8e1a9b5113
- SHA512 2f8aeb3d38edfd3f165fe86381f42154c877f741a87e8b9e88c779bf4802431c405e6609eaaf690a417930ff7887a99a8dc9b76fd1fa0711954a14af391b624c
- SSDEEP 12288:+ZGWOIehwmZ2/XM14Tjs+Bchv8fy8iKQpsz/v+JWnBo44E:PmwTZ2fbIkfyQQpsz+WnBT
- TLSH T17E059E59F2E800EEE077E538D5616A17E93278560F30AADF13D005697F336E44A7BB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger