General
- Target 2026-09-11_211acf2a514cdc339833ba11af5b6773_cobalt-strike_icedid_njrat_satacom_stealc
- Size 236KB
- Sample260912-pmd7bsbg82
- SHA256 c38560aa02b315dc19d7f52b2299cdefb112b3e5df5edc41d2825e0ae2551334
- MD5 211acf2a514cdc339833ba11af5b6773
- SHA1 1873b760a08d2fc5d23cc998b2a0d1cec7d2b717
- SHA512 b40a69dcd8819283e3c2507e5e34b02dd58e41f5418e754552370e93477f7f44a185eba2c74035bd011be77c627de21dd163b7455b37cc20dc3fd3bac00e4fbe
- SSDEEP 3072:QWYBaXeQ4oR43jiGdsAKRME1DSyLyLYi1z1to5wnqZXrn1AP6aED0RC:NXR4oRejiGdji9yLR1bn2e3
- TLSH T1C0345C19B6650CFDEA77C6B9CA524902EB727C460370EDDF07904AA31E236D49E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-11_211acf2a514cdc339833ba11af5b6773_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260911-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-11_211acf2a514cdc339833ba11af5b6773_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-11_211acf2a514cdc339833ba11af5b6773_cobalt-strike_icedid_njrat_satacom_stealc
- Size 236KB
- SHA256 c38560aa02b315dc19d7f52b2299cdefb112b3e5df5edc41d2825e0ae2551334
- MD5 211acf2a514cdc339833ba11af5b6773
- SHA1 1873b760a08d2fc5d23cc998b2a0d1cec7d2b717
- SHA512 b40a69dcd8819283e3c2507e5e34b02dd58e41f5418e754552370e93477f7f44a185eba2c74035bd011be77c627de21dd163b7455b37cc20dc3fd3bac00e4fbe
- SSDEEP 3072:QWYBaXeQ4oR43jiGdsAKRME1DSyLyLYi1z1to5wnqZXrn1AP6aED0RC:NXR4oRejiGdji9yLR1bn2e3
- TLSH T1C0345C19B6650CFDEA77C6B9CA524902EB727C460370EDDF07904AA31E236D49E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.