e1f41d3787616383cae9e323bd56656efb85ba860b088a513670554f73f2db7f

General

Target
2026-08-08_f0373e52511c90c760e380d6ec2d59e9_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.8MB
Sample260808-cwkdgsbb79
SHA256 e1f41d3787616383cae9e323bd56656efb85ba860b088a513670554f73f2db7f
MD5 f0373e52511c90c760e380d6ec2d59e9
SHA1 bc5b23efb5d03a3638437c5c67714dde20d7a398
SHA512 a4da0ed566e9ef2bf8cccd464bd06bdd4980cd40af0f9b4e3b3aecc379a8a531e5c30abae4cf807c658e2303b0dcff5fa63260a1463e902fb11ab67f4b01e43c
SSDEEP 24576:66afiQqeH4KNO3VGQ9uBn5qXso5oAG1B8KInTH+F6BvEo:6ZwA6sC6n5GsQO8xQ6
TLSH
T1E9958D1BB2B900EDD067C179CA165607EBB274550330ABDB17D08AA62F23EE55F7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-08_f0373e52511c90c760e380d6ec2d59e9_cobalt-strike_icedid_njrat_satacom_stealc
- Size 1.8MB
- SHA256 e1f41d3787616383cae9e323bd56656efb85ba860b088a513670554f73f2db7f
- MD5 f0373e52511c90c760e380d6ec2d59e9
- SHA1 bc5b23efb5d03a3638437c5c67714dde20d7a398
- SHA512 a4da0ed566e9ef2bf8cccd464bd06bdd4980cd40af0f9b4e3b3aecc379a8a531e5c30abae4cf807c658e2303b0dcff5fa63260a1463e902fb11ab67f4b01e43c
- SSDEEP 24576:66afiQqeH4KNO3VGQ9uBn5qXso5oAG1B8KInTH+F6BvEo:6ZwA6sC6n5GsQO8xQ6
- TLSH
  T1E9958D1BB2B900EDD067C179CA165607EBB274550330ABDB17D08AA62F23EE55F7E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution persistence spyware stealer
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables referencing combination of virtualization drivers
- Detects executables referencing many IR and analysis tools
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables referencing virtualization MAC addresses
- Enumerates VirtualBox registry keys
  defense_evasion
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Looks for VMWare services registry key.
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
behavioral1 behavioral2