General
- Target 2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc
- Size 15.8MB
- Sample260922-3d95ashg49
- SHA256 4d4d0f27b095cdf7f70cf91cf7c1de06671f19708010517f4b495f86fc9874c3
- MD5 f66e854cfcd34bf0a26a2514babb0cbd
- SHA1 12c1daac7c8584ab1fb5dd853e38dd7f652b5b82
- SHA512 9c0294f2199c0e8996df1fdef96f390fb48756e235ea9f539c6ada0a13c74f2a5b2e81b9cad62f6ac4f7b728877a3eb21e303f7c6c7a29907385b9d6346f567e
- SSDEEP 196608:K1cnk0blImIujKHo869Ts/KU2Sz0hGVLhpK2ftfWiwRQjX:nnk0blSksnFz0hGZhpK2luhO
- TLSH T1C0F69D45F2A251E8D57BC038C266A617FB7038BD43146AF79AD19A646F23BD06E3F700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260911-en
8 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc
- Size 15.8MB
- SHA256 4d4d0f27b095cdf7f70cf91cf7c1de06671f19708010517f4b495f86fc9874c3
- MD5 f66e854cfcd34bf0a26a2514babb0cbd
- SHA1 12c1daac7c8584ab1fb5dd853e38dd7f652b5b82
- SHA512 9c0294f2199c0e8996df1fdef96f390fb48756e235ea9f539c6ada0a13c74f2a5b2e81b9cad62f6ac4f7b728877a3eb21e303f7c6c7a29907385b9d6346f567e
- SSDEEP 196608:K1cnk0blImIujKHo869Ts/KU2Sz0hGVLhpK2ftfWiwRQjX:nnk0blSksnFz0hGZhpK2luhO
- TLSH T1C0F69D45F2A251E8D57BC038C266A617FB7038BD43146AF79AD19A646F23BD06E3F700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Modifies WinLogon for persistence
-
UAC bypass
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1