General
- Target 2026-08-22_ff51584b92eb87643668547842cfb61c_cobalt-strike_icedid_njrat_satacom_stealc
- Size 445KB
- Sample260822-y6xbpayflg
- SHA256 2fc7808cd29b5e2516adcc788ae48767aa1afbd3e9d4fce36d0caba0f3b75561
- MD5 ff51584b92eb87643668547842cfb61c
- SHA1 58ad76d7d63dfc9e59a1f220c0db378524f57db9
- SHA512 eecc10c99a22388c38d9abae53586a1fe6dd3631b30efa40301f2ff18e6bca2043c7101c87238d307920205fddacd65e281fb4dfaf10f3783dfa92c932a6f795
- SSDEEP 6144:6NDEVhOO2rnxR4mAtwXOo1deYTt5fytuQQ7AJRDNFscTg4T5pe8klf23v/9sSUkh:SdX5YYTtpquQQ78/vLe8l3tsSUO
- TLSH T1E7A4BE15F7A910FAEA67C17CCD524906EA727C460761E6CF03904A973F27AE48E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_ff51584b92eb87643668547842cfb61c_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_ff51584b92eb87643668547842cfb61c_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-22_ff51584b92eb87643668547842cfb61c_cobalt-strike_icedid_njrat_satacom_stealc
- Size 445KB
- SHA256 2fc7808cd29b5e2516adcc788ae48767aa1afbd3e9d4fce36d0caba0f3b75561
- MD5 ff51584b92eb87643668547842cfb61c
- SHA1 58ad76d7d63dfc9e59a1f220c0db378524f57db9
- SHA512 eecc10c99a22388c38d9abae53586a1fe6dd3631b30efa40301f2ff18e6bca2043c7101c87238d307920205fddacd65e281fb4dfaf10f3783dfa92c932a6f795
- SSDEEP 6144:6NDEVhOO2rnxR4mAtwXOo1deYTt5fytuQQ7AJRDNFscTg4T5pe8klf23v/9sSUkh:SdX5YYTtpquQQ78/vLe8l3tsSUO
- TLSH T1E7A4BE15F7A910FAEA67C17CCD524906EA727C460761E6CF03904A973F27AE48E3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Enumerates VirtualBox registry keys
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Suspicious use of SetThreadContext