General
- Target 2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc
- Size 343KB
- Sample260910-hc3nlssva1
- SHA256 f7231b2c7ae9eb3406afebaeafcb142a6867aabd2e316274847f16eba229bde1
- MD5 3220158cc726ee2778d885885b44407f
- SHA1 ebda375932630a32667c021d7df0856d6056fe72
- SHA512 0751d8f8afe68c73aba43135b58fb6efab3802d9b1d47c697d1c5735109e64282e513ac0a20726aa6aec6b460cf92969201ee0eb64139b91bd8c5288ef245a3d
- SSDEEP 6144:2H3QGQKcH9h5FlWl57cEOa6DRgJ9G/yJ6iR7HdC6Wv8AK:2XQX+JCDRgJ9J6iR5C6WT
- TLSH T185749D29FBA414F9E67BC17CC9530906EA72BC9A0760ABCF13944A562F237D05E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-08_3220158cc726ee2778d885885b44407f_cobalt-strike_icedid_njrat_satacom_stealc
- Size 343KB
- SHA256 f7231b2c7ae9eb3406afebaeafcb142a6867aabd2e316274847f16eba229bde1
- MD5 3220158cc726ee2778d885885b44407f
- SHA1 ebda375932630a32667c021d7df0856d6056fe72
- SHA512 0751d8f8afe68c73aba43135b58fb6efab3802d9b1d47c697d1c5735109e64282e513ac0a20726aa6aec6b460cf92969201ee0eb64139b91bd8c5288ef245a3d
- SSDEEP 6144:2H3QGQKcH9h5FlWl57cEOa6DRgJ9G/yJ6iR7HdC6Wv8AK:2XQX+JCDRgJ9J6iR5C6WT
- TLSH T185749D29FBA414F9E67BC17CC9530906EA72BC9A0760ABCF13944A562F237D05E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.