General
- Target 2026-08-10_18675c0c8ea02922b11e6f8e33284a5c_cobalt-strike_icedid_njrat_satacom_stealc
- Size 16.8MB
- Sample260810-mwwrmafq5y
- SHA256 bf3cf8f34e66229a9ae842c70351b0a594a53cd2fd2aa50bd1328a46cfa2b174
- MD5 18675c0c8ea02922b11e6f8e33284a5c
- SHA1 9b4194bfec91bb997f3913eae13da09c2ea2a7e2
- SHA512 98a755a79e51b453357b73165c9b0668bab643178594ec103823a6087f01f6bc855cc233b950607ad240f520f5c5a9200f1fd5404a837b00417b8054e90fe764
- SSDEEP 393216:0sdcptVS2I92h7AQJDN/FdcptVS2I92h7AQJ3:Hd2tV5I9dYVFd2tV5I9dY
- TLSH T1FA07234972F810ACF076D174C5AA561BD772786617319ADF03E409AA2F377F00ABB722
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_18675c0c8ea02922b11e6f8e33284a5c_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-10_18675c0c8ea02922b11e6f8e33284a5c_cobalt-strike_icedid_njrat_satacom_stealc
- Size 16.8MB
- SHA256 bf3cf8f34e66229a9ae842c70351b0a594a53cd2fd2aa50bd1328a46cfa2b174
- MD5 18675c0c8ea02922b11e6f8e33284a5c
- SHA1 9b4194bfec91bb997f3913eae13da09c2ea2a7e2
- SHA512 98a755a79e51b453357b73165c9b0668bab643178594ec103823a6087f01f6bc855cc233b950607ad240f520f5c5a9200f1fd5404a837b00417b8054e90fe764
- SSDEEP 393216:0sdcptVS2I92h7AQJDN/FdcptVS2I92h7AQJ3:Hd2tV5I9dYVFd2tV5I9dY
- TLSH T1FA07234972F810ACF076D174C5AA561BD772786617319ADF03E409AA2F377F00ABB722
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)