General
- Target 2026-08-21_a8b0d9e0d72fd214ad9160688b5acf92_cobalt-strike_icedid_njrat_ryuk_satacom_stealc
- Size 592KB
- Sample260821-bz42matycs
- SHA256 9ddd63b90a7adfe85e3c2fe6dfc544923ae917a75ecb07cf395320c06093d6d9
- MD5 a8b0d9e0d72fd214ad9160688b5acf92
- SHA1 8f0abd8d0d21a08a4607ef803f2c5009b7a98388
- SHA512 e9f1db5aa5c6f848456034d9eea004cd7506820d341ea6eedb303b0ee3d8e939909503afb20e99edd3b09e4a9246dac88d25d8ad193b4e4dc16f060260bc3d50
- SSDEEP 12288:20ajC9x4R90iDG1rFZuizc+pV6JlzkYn8ydDqbI:7h9xB1rFYiz9V67kYQ
- TLSH T1B4D46CABE77601E9D1BBC17880225622FA213C5DC73123E76A9546B11F21BE9BF3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-21_a8b0d9e0d72fd214ad9160688b5acf92_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_a8b0d9e0d72fd214ad9160688b5acf92_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-21_a8b0d9e0d72fd214ad9160688b5acf92_cobalt-strike_icedid_njrat_ryuk_satacom_stealc
- Size 592KB
- SHA256 9ddd63b90a7adfe85e3c2fe6dfc544923ae917a75ecb07cf395320c06093d6d9
- MD5 a8b0d9e0d72fd214ad9160688b5acf92
- SHA1 8f0abd8d0d21a08a4607ef803f2c5009b7a98388
- SHA512 e9f1db5aa5c6f848456034d9eea004cd7506820d341ea6eedb303b0ee3d8e939909503afb20e99edd3b09e4a9246dac88d25d8ad193b4e4dc16f060260bc3d50
- SSDEEP 12288:20ajC9x4R90iDG1rFZuizc+pV6JlzkYn8ydDqbI:7h9xB1rFYiz9V67kYQ
- TLSH T1B4D46CABE77601E9D1BBC17880225622FA213C5DC73123E76A9546B11F21BE9BF3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.