General
- Target 2026-08-22_9ce2b2026c6d2f27c6aafbf411d90235_cobalt-strike_icedid_njrat_satacom_stealc
- Size 445KB
- Sample260823-ejy28axvaw
- SHA256 3a9af121078fe87fd0a4c5bdaa388b9f0282c96711574b0d600e8f9968c40823
- MD5 9ce2b2026c6d2f27c6aafbf411d90235
- SHA1 0d180c525351ada4fe90156bc58385d5f29d12f7
- SHA512 179cb82e22808751bbc801153dbbd6187947218997ff8f8ca578d09216fa3f0290f90b73f40c53c1c014cfe105292c12d095bf3771589cd38bb8952ad08f4841
- SSDEEP 6144:UNdEVhOO2rnxR4mAtwXOo1deYTt5fytuQQ7APRDNhEy1/ySNtDgxL+7BqyammSh:qdX5YYTtpquQQ7GlBGL+o6mc
- TLSH T1C4A4BE15F7A810F9EA77C27CCD424906EA72BC560761E6CF03A04A972F276D49E3E760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_9ce2b2026c6d2f27c6aafbf411d90235_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_9ce2b2026c6d2f27c6aafbf411d90235_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-22_9ce2b2026c6d2f27c6aafbf411d90235_cobalt-strike_icedid_njrat_satacom_stealc
- Size 445KB
- SHA256 3a9af121078fe87fd0a4c5bdaa388b9f0282c96711574b0d600e8f9968c40823
- MD5 9ce2b2026c6d2f27c6aafbf411d90235
- SHA1 0d180c525351ada4fe90156bc58385d5f29d12f7
- SHA512 179cb82e22808751bbc801153dbbd6187947218997ff8f8ca578d09216fa3f0290f90b73f40c53c1c014cfe105292c12d095bf3771589cd38bb8952ad08f4841
- SSDEEP 6144:UNdEVhOO2rnxR4mAtwXOo1deYTt5fytuQQ7APRDNhEy1/ySNtDgxL+7BqyammSh:qdX5YYTtpquQQ7GlBGL+o6mc
- TLSH T1C4A4BE15F7A810F9EA77C27CCD424906EA72BC560761E6CF03A04A972F276D49E3E760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Enumerates VirtualBox registry keys
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Suspicious use of SetThreadContext