Extracted

Extracted

• • Target
    2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc
  • Size 365KB
  • SHA256 4e4b3cb215c162cf312c5177043947bbd3d654118b3ca7ed63af5d01eadfa537
  • MD5 6fe3306248c933240d34f9e0b7e4c012
  • SHA1 bece26b9cf43cd4a0d3863c48dba7072155de7ba
  • SHA512 b221714ab268ed39e5cfb66abed30385f78abafdacb3bdbc1488d6e2d88a0252db783b8a5a1a18e573b3fbf8085e4b6bd110fa5a31341755149f4ff1aa37963b
  • SSDEEP 6144:6xEZwfNSPYm1ESU3SPRpowRBZQbL1Ay6etyJOhcRXQZbdsanl6N:6TECjOZQbhd6C8acRgJ6anlo
  • TLSH
    T1D5847D19FBA404F9E1B7D17CC9634501EB727C9A4770AACF23A44AA61F236D09E3E711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealer

  • Disables Task Manager via registry modification

    defense_evasion

  • Drops file in Drivers directory

  • Manipulates Digital Signatures

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Boot or Logon Autostart Execution: Print Processors

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Modifies termsrv.dll

    Commonly used to allow simultaneous RDP sessions.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2