8b55adc6774727b3258be166892f685e066ac2334c7cccf420e75c2a718e13e6

General

Target
2026-08-15_2d6ebd24cec4ee394de79e6ba36492ad_cobalt-strike_icedid_njrat_satacom_stealc
Size 426KB
Sample260815-b37a6adj3y
SHA256 8b55adc6774727b3258be166892f685e066ac2334c7cccf420e75c2a718e13e6
MD5 2d6ebd24cec4ee394de79e6ba36492ad
SHA1 8b3977ce0c82c64ffd6e27ba8ffa921ab593d617
SHA512 d46caed4f8dbf298451081eb9dea46560a16e3f236674ad6364312d1c0d36180304c8062c8e943a639b95e38a20fdf65da772cfa445db662233a5cee49553e4a
SSDEEP 6144:c23RHT6u+jNTutAKP7iuIDdSambMtCKMz0J8qfRBQ1TH8GRcA:R3RWgzkdvmbbzjqJBm
TLSH
T1A1947D26E6A804FDE167D178C9574902EA7278464370E6CF03989E771F276E09E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-15_2d6ebd24cec4ee394de79e6ba36492ad_cobalt-strike_icedid_njrat_satacom_stealc
- Size 426KB
- SHA256 8b55adc6774727b3258be166892f685e066ac2334c7cccf420e75c2a718e13e6
- MD5 2d6ebd24cec4ee394de79e6ba36492ad
- SHA1 8b3977ce0c82c64ffd6e27ba8ffa921ab593d617
- SHA512 d46caed4f8dbf298451081eb9dea46560a16e3f236674ad6364312d1c0d36180304c8062c8e943a639b95e38a20fdf65da772cfa445db662233a5cee49553e4a
- SSDEEP 6144:c23RHT6u+jNTutAKP7iuIDdSambMtCKMz0J8qfRBQ1TH8GRcA:R3RWgzkdvmbbzjqJBm
- TLSH
  T1A1947D26E6A804FDE167D178C9574902EA7278464370E6CF03989E771F276E09E3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery persistence privilege_escalation
- Detects Windows executables referencing non-Windows User-Agents
- Detects executables referencing many IR and analysis tools
- Detects executables using Telegram Chat Bot
- Disables RegEdit via registry modification
  defense_evasion
- Disables Task Manager via registry modification
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2