General
- Target 2026-08-03_55440cd1a73ce011d703a7e786bafb16_cobalt-strike_icedid_njrat_satacom_stealc
- Size 728KB
- Sample260804-n3tfhsvzdz
- SHA256 7fdce191df1d7307db78656a84d6452123f6df54d7f95d1c3ece439184c2047f
- MD5 55440cd1a73ce011d703a7e786bafb16
- SHA1 5eee43adcae996b4f9d1fe47c0b0407890c067ab
- SHA512 70f51a5d0f2b7d3678b2e018002d27dce007fc500378c0ed5cee4bfa2e20202def9674db9e6138d1ab095429bac542563552c427e668ad85c2ee23af9fd56539
- SSDEEP 12288:9Y1f3N1TeVBetLNqyw04JYj3t2sD3asnoVAV6FsnyoWccOG:U3jTeVBeV4Bs3t2WasnoBFsny+cOG
- TLSH T137F49D54F6F402ECE0778138D9A6761BFA3278550B309ADF139405AD2F736D44ABBB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_55440cd1a73ce011d703a7e786bafb16_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_55440cd1a73ce011d703a7e786bafb16_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-03_55440cd1a73ce011d703a7e786bafb16_cobalt-strike_icedid_njrat_satacom_stealc
- Size 728KB
- SHA256 7fdce191df1d7307db78656a84d6452123f6df54d7f95d1c3ece439184c2047f
- MD5 55440cd1a73ce011d703a7e786bafb16
- SHA1 5eee43adcae996b4f9d1fe47c0b0407890c067ab
- SHA512 70f51a5d0f2b7d3678b2e018002d27dce007fc500378c0ed5cee4bfa2e20202def9674db9e6138d1ab095429bac542563552c427e668ad85c2ee23af9fd56539
- SSDEEP 12288:9Y1f3N1TeVBetLNqyw04JYj3t2sD3asnoVAV6FsnyoWccOG:U3jTeVBeV4Bs3t2WasnoBFsny+cOG
- TLSH T137F49D54F6F402ECE0778138D9A6761BFA3278550B309ADF139405AD2F736D44ABBB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger