Extracted

Extracted

• • Target
    2026-08-07_80cd5da6a6bde92ebc95e18c50ed428b_cobalt-strike_icedid_njrat_satacom_stealc
  • Size 322KB
  • SHA256 aa312dfdfaa4abcc516b8e28e51d08fae83797ddf97c7bca77cccea8b1c9f25e
  • MD5 80cd5da6a6bde92ebc95e18c50ed428b
  • SHA1 10b68f39b37556b0497ebc6d1aaee624d907d2b8
  • SHA512 32c82c00977807407f4138d55701f1ec807b9dbcb0ee7538f7cd39b1157603cae78228a0922167cc838a6138fcd402febcd369258804934123a4699425f0c1dc
  • SSDEEP 6144:D00GUJHKr2ztjp9+aDv9kR4OOfduhp0b+fK:Yg4aDVkRPOcpw
  • TLSH
    T1C5646C19F7A414F9E6A7D17CC9834506EBB2BC524761EACF13A04A963F236D08E3E711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealer

  • Disables Task Manager via registry modification

    defense_evasion

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Boot or Logon Autostart Execution: Print Processors

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Modifies termsrv.dll

    Commonly used to allow simultaneous RDP sessions.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2