General
- Target 2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom
- Size 3.6MB
- Sample260924-ckdfssbg83
- SHA256 d9740220c7a6ecc00a8851aaf76bae458b353b7ab3fd8019406eed1d7286097b
Score
10/10
Malware Config
Targets
-
- Target 2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom
- Size 3.6MB
- SHA256 d9740220c7a6ecc00a8851aaf76bae458b353b7ab3fd8019406eed1d7286097b
Score10/10-
Detect SalatStealer payload
-
Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Enumerates VirtualBox registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
UPX dump on OEP (original entry point)
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.