General
- Target 2026-08-21_47c16a76f32206157e0d3e9e8ea1ac9a_cobalt-strike_icedid_satacom_stealc
- Size 842KB
- Sample260821-m8ec4sba76
- SHA256 4aa3b02da9e167d68a560eab58908e74f096743be97458686b82ae89631e2be0
- MD5 47c16a76f32206157e0d3e9e8ea1ac9a
- SHA1 1de6775ff72360b1853d004d35d259eabcec546c
- SHA512 70c5f5d67e20ba9009ae1a24ac984cb6f37e594aef833a525af43917d4aef0186a936ff98fd3f0150a87c5e9862f346bdb4f28500a0a393b1b0bcd1be6538c41
- SSDEEP 24576:30ZUPTDkYEqeHe5rS0waB7dxXurDTWEMfGLQBmmM90pgZ0if5jcU3vIkD5kFU6s6:WXkOG
- TLSH T11F0593A9326364F7F56B907323A4A407942E2817CB14CEE703D86FE77D526CA0D7D286
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-21_47c16a76f32206157e0d3e9e8ea1ac9a_cobalt-strike_icedid_satacom_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_47c16a76f32206157e0d3e9e8ea1ac9a_cobalt-strike_icedid_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-21_47c16a76f32206157e0d3e9e8ea1ac9a_cobalt-strike_icedid_satacom_stealc
- Size 842KB
- SHA256 4aa3b02da9e167d68a560eab58908e74f096743be97458686b82ae89631e2be0
- MD5 47c16a76f32206157e0d3e9e8ea1ac9a
- SHA1 1de6775ff72360b1853d004d35d259eabcec546c
- SHA512 70c5f5d67e20ba9009ae1a24ac984cb6f37e594aef833a525af43917d4aef0186a936ff98fd3f0150a87c5e9862f346bdb4f28500a0a393b1b0bcd1be6538c41
- SSDEEP 24576:30ZUPTDkYEqeHe5rS0waB7dxXurDTWEMfGLQBmmM90pgZ0if5jcU3vIkD5kFU6s6:WXkOG
- TLSH T11F0593A9326364F7F56B907323A4A407942E2817CB14CEE703D86FE77D526CA0D7D286
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1