eab711e6d34df59df993829b57412b922133e058bc8e38e223da66cf01067332

General

Target
2026-08-07_81675cfb5211dc20cdbf89b5756e72ff_cobalt-strike_icedid_njrat_satacom_stealc
Size 458KB
Sample260807-ykn37avyft
SHA256 eab711e6d34df59df993829b57412b922133e058bc8e38e223da66cf01067332
MD5 81675cfb5211dc20cdbf89b5756e72ff
SHA1 593a4ecd7fa552f600c5cbd7a4e196262614c90a
SHA512 90a9fdce1e7542869454bbc619f12893508aa01d86f71463d1d0cf2aac5c4282125e9ba4d2233077e19697fbe50a7c324f17bbdfa5c7ae72933369299c8a42d1
SSDEEP 6144:fI2Csj4INzNPzw9tY1tZTHPTthH2nat6cKtC4/rvXBAqn/TuWsYonF5wmnKd9aZc:Quj4EM9tMtFPbIZsFbKd94Qy/U+C
TLSH
T1CBA45C56A6A804F9E173D1BCCD574902E772784A0721EBCF0390EA761E276D49E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-07_81675cfb5211dc20cdbf89b5756e72ff_cobalt-strike_icedid_njrat_satacom_stealc
- Size 458KB
- SHA256 eab711e6d34df59df993829b57412b922133e058bc8e38e223da66cf01067332
- MD5 81675cfb5211dc20cdbf89b5756e72ff
- SHA1 593a4ecd7fa552f600c5cbd7a4e196262614c90a
- SHA512 90a9fdce1e7542869454bbc619f12893508aa01d86f71463d1d0cf2aac5c4282125e9ba4d2233077e19697fbe50a7c324f17bbdfa5c7ae72933369299c8a42d1
- SSDEEP 6144:fI2Csj4INzNPzw9tY1tZTHPTthH2nat6cKtC4/rvXBAqn/TuWsYonF5wmnKd9aZc:Quj4EM9tMtFPbIZsFbKd94Qy/U+C
- TLSH
  T1CBA45C56A6A804F9E173D1BCCD574902E772784A0721EBCF0390EA761E276D49E3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer
- Clears Windows event logs
  defense_evasion ransomware
- Custom signature
  
  Detects executables containing commands for clearing Windows Event Logs
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2