ba67df6dbd82a30ba20600d89d5e5529cc29fea988bc53a292d2cc0be309b6ab | Triage™

Login
Reports

Overview

overview

8

Static

static

3

2026-09-08...om.exe

windows10-2004-x64

1

2026-09-08...om.exe

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_7fdaadc4a70f347cd9cc782ed6b988d5_cobalt-strike_icedid_njrat_satacom
Size 172KB
Sample260910-e79hvsfe29
SHA256 ba67df6dbd82a30ba20600d89d5e5529cc29fea988bc53a292d2cc0be309b6ab
MD5 7fdaadc4a70f347cd9cc782ed6b988d5
SHA1 839261ec2e746f3ef3b0ecfb9fc5322ceb2a3611
SHA512 75a82455934e1f3269dda7500042873dff901885ec93649ab5e5f65b58c46b8183748a1d0824aceb25a5bec5e240476adff4f7aaed5d673ff033ff8457621f61
SSDEEP 3072:tUuAMKSIRMk9NgG6P/SJmenPIBvuyBADeFpVcWnh1:tUuADMk9Ngr/6nPoADLWh1
TLSH
T1C5046C47B3E520F9E177823889A24506F77274361B618FEF03A446B96F237D09D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

backdoor defense_evasion discovery execution persistence privilege_escalation rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2026-09-08_7fdaadc4a70f347cd9cc782ed6b988d5_cobalt-strike_icedid_njrat_satacom.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

2026-09-08_7fdaadc4a70f347cd9cc782ed6b988d5_cobalt-strike_icedid_njrat_satacom.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

17 signatures

150 seconds

backdoor defense_evasion discovery execution persistence privilege_escalation rat

Malware Config

Targets

- Target
  2026-09-08_7fdaadc4a70f347cd9cc782ed6b988d5_cobalt-strike_icedid_njrat_satacom
- Size 172KB
- SHA256 ba67df6dbd82a30ba20600d89d5e5529cc29fea988bc53a292d2cc0be309b6ab
- MD5 7fdaadc4a70f347cd9cc782ed6b988d5
- SHA1 839261ec2e746f3ef3b0ecfb9fc5322ceb2a3611
- SHA512 75a82455934e1f3269dda7500042873dff901885ec93649ab5e5f65b58c46b8183748a1d0824aceb25a5bec5e240476adff4f7aaed5d673ff033ff8457621f61
- SSDEEP 3072:tUuAMKSIRMk9NgG6P/SJmenPIBvuyBADeFpVcWnh1:tUuADMk9Ngr/6nPoADLWh1
- TLSH
  T1C5046C47B3E520F9E177823889A24506F77274361B618FEF03A446B96F237D09D3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

backdoor defense_evasion discovery execution persistence privilege_escalation rat
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- SimpleHelp remote administration tool
  SimpleHelp is a remote administration tool that can be used as a backdoor
  backdoor rat
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

File and Directory Permissions Modification

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationrat

© 2018-2026

Terms | Privacy