General
- Target 2026-10-06_2c544018628960b1d00666c29ba5c61c_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.2MB
- Sample261006-ryjmasfc52
- SHA256 7b2f460dc196f6a62efd398f58143f81c9c16263f1365839f6c8c947b8e6f9c9
- MD5 2c544018628960b1d00666c29ba5c61c
- SHA1 977ebeda79db0f1fb716e75709a6d64bc5e93369
- SHA512 bdcf700557b82e1610eab77e7703e44a15dfea134a4d9c832349ec7e1aa610259bbfe8b3547f61d0cda9289f4872c094e283a804cc410c2b1dfffd82190bacf6
- SSDEEP 49152:ba2bhGgmFVrD2L6cDBL1JG3luwLbDpKHUg9XJg9LAg:nbwxr6LDG3lxbDpYXaH
- TLSH T194A58D57A2B900EDD067C1B9CA165613E772B4450730BBDF13908AA62F27BE15BBF720
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-06_2c544018628960b1d00666c29ba5c61c_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-06_2c544018628960b1d00666c29ba5c61c_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.2MB
- SHA256 7b2f460dc196f6a62efd398f58143f81c9c16263f1365839f6c8c947b8e6f9c9
- MD5 2c544018628960b1d00666c29ba5c61c
- SHA1 977ebeda79db0f1fb716e75709a6d64bc5e93369
- SHA512 bdcf700557b82e1610eab77e7703e44a15dfea134a4d9c832349ec7e1aa610259bbfe8b3547f61d0cda9289f4872c094e283a804cc410c2b1dfffd82190bacf6
- SSDEEP 49152:ba2bhGgmFVrD2L6cDBL1JG3luwLbDpKHUg9XJg9LAg:nbwxr6LDG3lxbDpYXaH
- TLSH T194A58D57A2B900EDD067C1B9CA165613E772B4450730BBDF13908AA62F27BE15BBF720
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1