General
- Target 2026-08-22_c4fcebdf71b3df99e1e14b2cfffb2a25_cobalt-strike_icedid_njrat_satacom_stealc
- Size 17.8MB
- Sample260822-d33dbavvgy
- SHA256 36f4ed886d0e1f4fc2532b1a6e8312dbc4fca54be25b3e20b2b569a813aeab01
- MD5 c4fcebdf71b3df99e1e14b2cfffb2a25
- SHA1 39fa26691e53f786921486299e6f6f4fae76ef59
- SHA512 7deb1cdab5b0c5b007b0104ef2f35d7a8bc327ce243e11702ea2cd8adb0d027fa9a66703586af2f891098e714baae79113b1ef9b63368ca2d2e80b9e124a22b5
- SSDEEP 393216:4OMUy+N+qwUYnySfxccj3VQjoazEH9ldhe:49Uy4wU7a3VQjzzW9ldh
- TLSH T1CC173315A6B402F8D0BBD2B4DE534913EA72784953319AFB02D192561F2BEE0DE3EF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-22_c4fcebdf71b3df99e1e14b2cfffb2a25_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_c4fcebdf71b3df99e1e14b2cfffb2a25_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260710-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-22_c4fcebdf71b3df99e1e14b2cfffb2a25_cobalt-strike_icedid_njrat_satacom_stealc
- Size 17.8MB
- SHA256 36f4ed886d0e1f4fc2532b1a6e8312dbc4fca54be25b3e20b2b569a813aeab01
- MD5 c4fcebdf71b3df99e1e14b2cfffb2a25
- SHA1 39fa26691e53f786921486299e6f6f4fae76ef59
- SHA512 7deb1cdab5b0c5b007b0104ef2f35d7a8bc327ce243e11702ea2cd8adb0d027fa9a66703586af2f891098e714baae79113b1ef9b63368ca2d2e80b9e124a22b5
- SSDEEP 393216:4OMUy+N+qwUYnySfxccj3VQjoazEH9ldhe:49Uy4wU7a3VQjzzW9ldh
- TLSH T1CC173315A6B402F8D0BBD2B4DE534913EA72784953319AFB02D192561F2BEE0DE3EF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE