General
- Target 2026-08-08_569fdb1eae0089c1fb128b9310b53e7e_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.5MB
- Sample260808-jk2a7acd59
- SHA256 2a3ae9451d6330bb2fd2d0263f947be86e6b0030602c3dbf439030d783ad6a24
- MD5 569fdb1eae0089c1fb128b9310b53e7e
- SHA1 7d4b10a89752f8ab16af55649f25fdd9e56a049d
- SHA512 445f126d5e7aea051808b2f3de7cf43cf245e563a60eb1e0f1e0ae07a7a05d1661c4f54cbb829eb43b5d102400e617db42d535b6b34eef25867ba560e14c8bfa
- SSDEEP 49152:luUfb352ZHlYrvKjz+WjO4Li5YrVma37LpvgY1qFshlOjsMzA24qL5Ged6Tz6:ztm+WLLiux5PpvgeqFKOjs2ZJJd6T
- TLSH T1EBC51216E6A500FDD1B791B8D9630806E6727C8A0360DEDF0354EBA61F276E09F3BB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-08_569fdb1eae0089c1fb128b9310b53e7e_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_569fdb1eae0089c1fb128b9310b53e7e_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-08_569fdb1eae0089c1fb128b9310b53e7e_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.5MB
- SHA256 2a3ae9451d6330bb2fd2d0263f947be86e6b0030602c3dbf439030d783ad6a24
- MD5 569fdb1eae0089c1fb128b9310b53e7e
- SHA1 7d4b10a89752f8ab16af55649f25fdd9e56a049d
- SHA512 445f126d5e7aea051808b2f3de7cf43cf245e563a60eb1e0f1e0ae07a7a05d1661c4f54cbb829eb43b5d102400e617db42d535b6b34eef25867ba560e14c8bfa
- SSDEEP 49152:luUfb352ZHlYrvKjz+WjO4Li5YrVma37LpvgY1qFshlOjsMzA24qL5Ged6Tz6:ztm+WLLiux5PpvgeqFKOjs2ZJJd6T
- TLSH T1EBC51216E6A500FDD1B791B8D9630806E6727C8A0360DEDF0354EBA61F276E09F3BB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Enumerates VirtualBox registry keys
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Suspicious use of NtSetInformationThreadHideFromDebugger