General
- Target 2026-09-16_40a08227475b633b38dc994abcdfa669_blackenergy_cobalt-strike_icedid_njrat_ryuk_satacom_stealc
- Size 5.0MB
- Sample260916-15kydawdpg
- SHA256 db864ff6e381d2ce3ece21436bc9ab89be0b230f972acd21a55e075f74623c4c
- MD5 40a08227475b633b38dc994abcdfa669
- SHA1 e0b89e561b5ceca780d7a4e1c4830444c72644e4
- SHA512 9e1c0d4c96ebc5d4ccfb45a2e7a1ae99ce3cd16fa941d4b2f8f2c8a0a730c16bbde846e9f991f2d18f9436a2fbe61261a979721edbf5d740e150aa73f7246173
- SSDEEP 12288:qMDHerQJBUTjFS8NWFk4DT0fUUSwN2qyo2gSIWyBHzb6IEUT:qMtfUfFS8NWFk43Yz2qyo20+/U
- TLSH T1E2364C09B76259B9D09ED7B0C7825155F330B6184FB8AC9F07905A1E1EE2F806F27B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-16_40a08227475b633b38dc994abcdfa669_blackenergy_cobalt-strike_icedid_njrat_ryuk_satacom_stealc.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-16_40a08227475b633b38dc994abcdfa669_blackenergy_cobalt-strike_icedid_njrat_ryuk_satacom_stealc
- Size 5.0MB
- SHA256 db864ff6e381d2ce3ece21436bc9ab89be0b230f972acd21a55e075f74623c4c
- MD5 40a08227475b633b38dc994abcdfa669
- SHA1 e0b89e561b5ceca780d7a4e1c4830444c72644e4
- SHA512 9e1c0d4c96ebc5d4ccfb45a2e7a1ae99ce3cd16fa941d4b2f8f2c8a0a730c16bbde846e9f991f2d18f9436a2fbe61261a979721edbf5d740e150aa73f7246173
- SSDEEP 12288:qMDHerQJBUTjFS8NWFk4DT0fUUSwN2qyo2gSIWyBHzb6IEUT:qMtfUfFS8NWFk43Yz2qyo20+/U
- TLSH T1E2364C09B76259B9D09ED7B0C7825155F330B6184FB8AC9F07905A1E1EE2F806F27B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Stealc stealer Version 3
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.