Extracted

• • Target
    2026-08-15_528ae9e70ce9a14f87df307e6d6f6c02_cobalt-strike_icedid_njrat_satacom
  • Size 154KB
  • SHA256 a14d7a125cf32085348a44f6fa4111d5519537008d12c2fe7914fe97b974b260
  • MD5 528ae9e70ce9a14f87df307e6d6f6c02
  • SHA1 9e6ccd78591e580c6a9ba4ec8515b3854ae542ad
  • SHA512 56821b1869d4805ca7b48fca8dd26c0d8b151446c5706d8bb9bc5fae234d919ec70dd2bb1174cb54296697111777eddc7c137d89d781e88eb572e124a984aa28
  • SSDEEP 3072:wMAVkmWr0EzUIVgpHpHZu21wh645/TAPpngdQ:fmWr0sUI2AuwhfUqdQ
  • TLSH
    T1EBF35C57B7A631F9E1B7923989A10506F77278310B209BEF039447752F232D19E3EB61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  execution

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution
  behavioral1behavioral2