General
- Target 2026-08-11_4262760d77a4d1b00322cc876c130c6e_cobalt-strike_icedid_njrat_satacom_stealc
- Size 15.4MB
- Sample260811-2vbgmatele
- SHA256 67929357b33f7919bc7b5a77e935d3127d7f596040b5834e60351f0218d424d1
- MD5 4262760d77a4d1b00322cc876c130c6e
- SHA1 1e30a932107532e305c66a97f4ec96dba295bae9
- SHA512 ae9e6b4eebe18e68e74ed91101d48f7163c142acdf487ecec1432fd9a3b493a40e2adb29db3c5a9b2d06722558545f46c613a03b4cbe0384116b84a806444565
- SSDEEP 393216:v6XTvcLXftB5GjJAF1GjJAF4PAmk1T1x:v+v68dHQpz
- TLSH T13BF6CFB5975C9B4EE066B038C583832797F1BC0D1761CF8BBAC4AD675E2F184FA19209
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-11_4262760d77a4d1b00322cc876c130c6e_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_4262760d77a4d1b00322cc876c130c6e_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-11_4262760d77a4d1b00322cc876c130c6e_cobalt-strike_icedid_njrat_satacom_stealc
- Size 15.4MB
- SHA256 67929357b33f7919bc7b5a77e935d3127d7f596040b5834e60351f0218d424d1
- MD5 4262760d77a4d1b00322cc876c130c6e
- SHA1 1e30a932107532e305c66a97f4ec96dba295bae9
- SHA512 ae9e6b4eebe18e68e74ed91101d48f7163c142acdf487ecec1432fd9a3b493a40e2adb29db3c5a9b2d06722558545f46c613a03b4cbe0384116b84a806444565
- SSDEEP 393216:v6XTvcLXftB5GjJAF1GjJAF4PAmk1T1x:v+v68dHQpz
- TLSH T13BF6CFB5975C9B4EE066B038C583832797F1BC0D1761CF8BBAC4AD675E2F184FA19209
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Enumerates VirtualBox registry keys
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Suspicious use of NtSetInformationThreadHideFromDebugger