e2daf7cdb6cf0124cd7791ef76503fe953d072a98e7920e67046fe368e9ceb16

General

Target
2026-08-07_498d24a1c9fd1de17557e28b972b2175_cobalt-strike_icedid_njrat_satacom_stealc
Size 356KB
Sample260807-2b3f1axvaw
SHA256 e2daf7cdb6cf0124cd7791ef76503fe953d072a98e7920e67046fe368e9ceb16
MD5 498d24a1c9fd1de17557e28b972b2175
SHA1 f8107395d17388691009cfa1612b3c16a880385f
SHA512 4a601484a39d1d50a1f2f5a73171b0c66b92e05f7ae21201c28416a64d0717f82229de7f351aa479b29d3ae484c90be9414c0257133547d49034d34ab55f9841
SSDEEP 6144:I1MX81ncEGN3MHzi3EYXpv8yRwYRZ1W07ghwwmzqEcN+uhbQBN:OQkoUyRwq7W078CzqZRIN
TLSH
T109747C15FBA504F9E177C17CCA634506EB727C8A47B1ABCB23A04A961F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note

*** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : ZCSDUGWG IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Targets

- Target
  2026-08-07_498d24a1c9fd1de17557e28b972b2175_cobalt-strike_icedid_njrat_satacom_stealc
- Size 356KB
- SHA256 e2daf7cdb6cf0124cd7791ef76503fe953d072a98e7920e67046fe368e9ceb16
- MD5 498d24a1c9fd1de17557e28b972b2175
- SHA1 f8107395d17388691009cfa1612b3c16a880385f
- SHA512 4a601484a39d1d50a1f2f5a73171b0c66b92e05f7ae21201c28416a64d0717f82229de7f351aa479b29d3ae484c90be9414c0257133547d49034d34ab55f9841
- SSDEEP 6144:I1MX81ncEGN3MHzi3EYXpv8yRwYRZ1W07ghwwmzqEcN+uhbQBN:OQkoUyRwq7W078CzqZRIN
- TLSH
  T109747C15FBA504F9E177C17CCA634506EB727C8A47B1ABCB23A04A961F236D09E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery ransomware execution persistence privilege_escalation spyware stealer
- Disables Task Manager via registry modification
  defense_evasion
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
- Modifies termsrv.dll
  Commonly used to allow simultaneous RDP sessions.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2