General
- Target 2026-10-14_4547f1859632c08c43ecd51467c04aab_cobalt-strike_icedid_njrat_satacom
- Size 3.0MB
- Sample261014-2ebgpazz2q
- SHA256 d4ba7ba3ec03b123121545f4f6d0e613e670be64f54912fdf07070929276a166
- MD5 4547f1859632c08c43ecd51467c04aab
- SHA1 433837eb04ed835840ea4d135d58943ace057947
- SHA512 f6ca32453440dfee548123ac32d6e1dbc909ed32659705dfa559cd48b128bdabe79331af6c30d49e871797ec365074da7fbc8d54b2aaeca7ec3da68f394ab9d8
- SSDEEP 98304:rcdxh/PfjKMtYWi7GfLG1u4TK0whkWlARO:rcdxhXfjKMtYWi7GC1XTVwhkW6RO
- TLSH T170E5338992E050F9D4338678CBD14B02B633781A0315AAE717E5937A9E136D1EE39F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
7 signatures
Behavioral task
behavioral1
Sample
2026-10-14_4547f1859632c08c43ecd51467c04aab_cobalt-strike_icedid_njrat_satacom.exe
Resource
win10v2004-20260911-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-14_4547f1859632c08c43ecd51467c04aab_cobalt-strike_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260911-en
10 signatures
150 seconds
Malware Config
Extracted
Family
-
ratonrat
Version
-
Professional
Mutex
-
6S7WYE0NPguKCb8CEHFAlEZ
Attributes
-
assist
false
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
false
-
delay
0
-
hide_file
false
-
open_website
false
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
false
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/example
Targets
-
- Target 2026-10-14_4547f1859632c08c43ecd51467c04aab_cobalt-strike_icedid_njrat_satacom
- Size 3.0MB
- SHA256 d4ba7ba3ec03b123121545f4f6d0e613e670be64f54912fdf07070929276a166
- MD5 4547f1859632c08c43ecd51467c04aab
- SHA1 433837eb04ed835840ea4d135d58943ace057947
- SHA512 f6ca32453440dfee548123ac32d6e1dbc909ed32659705dfa559cd48b128bdabe79331af6c30d49e871797ec365074da7fbc8d54b2aaeca7ec3da68f394ab9d8
- SSDEEP 98304:rcdxh/PfjKMtYWi7GfLG1u4TK0whkWlARO:rcdxhXfjKMtYWi7GC1XTVwhkW6RO
- TLSH T170E5338992E050F9D4338678CBD14B02B633781A0315AAE717E5937A9E136D1EE39F27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Detects DonutLoader
-
Detects RatonRAT payload
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Detects Windows executables referencing non-Windows User-Agents
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
-
Detects executables manipulated with Fody
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt