General
- Target 2026-09-03_ce9283a71ada960924ab9b8f7dd5b3cb_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom
- Size 97.0MB
- Sample260903-2ach7attby
- SHA256 df53573047a882a850015e1c6170bf38776ff282b0aadb6e78cf21d6fba5b996
- MD5 ce9283a71ada960924ab9b8f7dd5b3cb
- SHA1 182e0755b53ad63ba5c3ed9b29be6ae4629043de
- SHA512 71185523b84d331f328769d7a14960252ef6228c1f55edc8cd835ae48ee9944066defd38afe0640beda03d8a0aa00c43654ee957f583522055683842bb0d7408
- SSDEEP 1572864:x4xQT1TApDqzX2QNgeweka0l/m13ulWhvvAPho1Alo0yOfKJK1r:xrTAwz2S0khwq18oluKM1
- TLSH T16A280A9C431EDCD56BC03A7FFAD221716AE0B88A86F424D94F89B2CDCD84BD15D460E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-09-03_ce9283a71ada960924ab9b8f7dd5b3cb_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-03_ce9283a71ada960924ab9b8f7dd5b3cb_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260709-en
0 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-03_ce9283a71ada960924ab9b8f7dd5b3cb_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom
- Size 97.0MB
- SHA256 df53573047a882a850015e1c6170bf38776ff282b0aadb6e78cf21d6fba5b996
- MD5 ce9283a71ada960924ab9b8f7dd5b3cb
- SHA1 182e0755b53ad63ba5c3ed9b29be6ae4629043de
- SHA512 71185523b84d331f328769d7a14960252ef6228c1f55edc8cd835ae48ee9944066defd38afe0640beda03d8a0aa00c43654ee957f583522055683842bb0d7408
- SSDEEP 1572864:x4xQT1TApDqzX2QNgeweka0l/m13ulWhvvAPho1Alo0yOfKJK1r:xrTAwz2S0khwq18oluKM1
- TLSH T16A280A9C431EDCD56BC03A7FFAD221716AE0B88A86F424D94F89B2CDCD84BD15D460E6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE