General
- Target 2026-10-10_bad433e245083994dc51c1616827c924_cobalt-strike_icedid_njrat_satacom
- Size 320KB
- Sample261011-eqraysey7x
- SHA256 0385f1405e65c2e52bb56b1898e89b7f362ae12e13cfe601df6f64817929541e
- MD5 bad433e245083994dc51c1616827c924
- SHA1 8820175da965395ed095f6891e22564eb010d2c5
- SHA512 fb57e3210696b3fba6ae9cc0a20516c481e72359d75dd889289a56659bde10a2ac42834e08e76dce4978ecf3eea1c1eb95e6d69106626ff0faa0f74658f83188
- SSDEEP 6144:5Ily/4st6hj3EhvQNIjSZAP2ChpSJjvCJq7U6sBUA:Ss/dKEhyIjP2CsjaqA60
- TLSH T15064E055F3E914F5E063927889958304E672BC2607216BEF33A04A5A3F232D59E3EF71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-10_bad433e245083994dc51c1616827c924_cobalt-strike_icedid_njrat_satacom.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-10_bad433e245083994dc51c1616827c924_cobalt-strike_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-10_bad433e245083994dc51c1616827c924_cobalt-strike_icedid_njrat_satacom
- Size 320KB
- SHA256 0385f1405e65c2e52bb56b1898e89b7f362ae12e13cfe601df6f64817929541e
- MD5 bad433e245083994dc51c1616827c924
- SHA1 8820175da965395ed095f6891e22564eb010d2c5
- SHA512 fb57e3210696b3fba6ae9cc0a20516c481e72359d75dd889289a56659bde10a2ac42834e08e76dce4978ecf3eea1c1eb95e6d69106626ff0faa0f74658f83188
- SSDEEP 6144:5Ily/4st6hj3EhvQNIjSZAP2ChpSJjvCJq7U6sBUA:Ss/dKEhyIjP2CsjaqA60
- TLSH T15064E055F3E914F5E063927889958304E672BC2607216BEF33A04A5A3F232D59E3EF71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.