General
- Target 2026-08-17_418771d2e581349a9282eeba5831e771_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.0MB
- Sample260817-qpparastgz
- SHA256 e8795533f328c719fa8d720531ca1bef8bb2cdb4627228a8ef00188e5030e5a2
- MD5 418771d2e581349a9282eeba5831e771
- SHA1 c784b0179fac6fb19aa09af40d4da731c4f06d78
- SHA512 0a0b9828a6b6e45ef0b050976b9c60480d77e28e58ebda89d7d91e50c33af2a350ebf4a9dfd7d7cdd9af86263ce10ec4588ab8d0d7c8cec43a5ebf80dc3abe26
- SSDEEP 49152:mrSFZUCVQwoQeiNUqR9U4oHApYpmgfVB60wLEvEz3Fs:wSqbqvU4oKYQgfVALkx
- TLSH T1B4A5AE22EA5801BCD1B7D2F4EE275C03E276784A07356DDF039069A71F165A84B7FE22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-17_418771d2e581349a9282eeba5831e771_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_418771d2e581349a9282eeba5831e771_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260710-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-17_418771d2e581349a9282eeba5831e771_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.0MB
- SHA256 e8795533f328c719fa8d720531ca1bef8bb2cdb4627228a8ef00188e5030e5a2
- MD5 418771d2e581349a9282eeba5831e771
- SHA1 c784b0179fac6fb19aa09af40d4da731c4f06d78
- SHA512 0a0b9828a6b6e45ef0b050976b9c60480d77e28e58ebda89d7d91e50c33af2a350ebf4a9dfd7d7cdd9af86263ce10ec4588ab8d0d7c8cec43a5ebf80dc3abe26
- SSDEEP 49152:mrSFZUCVQwoQeiNUqR9U4oHApYpmgfVB60wLEvEz3Fs:wSqbqvU4oKYQgfVALkx
- TLSH T1B4A5AE22EA5801BCD1B7D2F4EE275C03E276784A07356DDF039069A71F165A84B7FE22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Enumerates VirtualBox registry keys
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Modifies boot configuration data using bcdedit