General
- Target 2026-08-04_8cde57ef9e9ca893647d77c261c52dd3_cobalt-strike_icedid_njrat_satacom
- Size 3.0MB
- Sample260804-g4vlmsshke
- SHA256 cb6185e42ba441169c8c4988a4f66672a21fd49fea80dec13ecec279ed960d90
- MD5 8cde57ef9e9ca893647d77c261c52dd3
- SHA1 21e478896717ca5cd810ddcc614ee8b9e2533c05
- SHA512 74245ad1d5030e198c0b2c12c76eb361b2c159ce0817228d5ac80507e561805ca577b4447303f50c410bea8d75a91d3f312a492c301b200d8ea41b89c5e76daf
- SSDEEP 49152:19VkKfxD4Kkecazjxm6H1/1FeNgR8QQr7SILo3BQat1j2yd6qGOM0lv8WMDq7cVh:DZbzJvxmcb8cfQDExQc/dWOM0vAW7U
- TLSH T185E523A1A3E801F5E43791398D958947E6B2B8051734E7DB03E495352F33AE3A93FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_8cde57ef9e9ca893647d77c261c52dd3_cobalt-strike_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_8cde57ef9e9ca893647d77c261c52dd3_cobalt-strike_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-04_8cde57ef9e9ca893647d77c261c52dd3_cobalt-strike_icedid_njrat_satacom
- Size 3.0MB
- SHA256 cb6185e42ba441169c8c4988a4f66672a21fd49fea80dec13ecec279ed960d90
- MD5 8cde57ef9e9ca893647d77c261c52dd3
- SHA1 21e478896717ca5cd810ddcc614ee8b9e2533c05
- SHA512 74245ad1d5030e198c0b2c12c76eb361b2c159ce0817228d5ac80507e561805ca577b4447303f50c410bea8d75a91d3f312a492c301b200d8ea41b89c5e76daf
- SSDEEP 49152:19VkKfxD4Kkecazjxm6H1/1FeNgR8QQr7SILo3BQat1j2yd6qGOM0lv8WMDq7cVh:DZbzJvxmcb8cfQDExQc/dWOM0vAW7U
- TLSH T185E523A1A3E801F5E43791398D958947E6B2B8051734E7DB03E495352F33AE3A93FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Executes dropped EXE
-
Suspicious use of SetThreadContext