General
- Target 2026-10-13_d86db419557e911776e779f66e92c74f_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.9MB
- Sample261014-e8dsksyvfy
- SHA256 4ff6a72fcbcfab29742e377c615a6f8cabef364a1fbe7e21eaaf65371c41eaf1
Score
9/10
Malware Config
Targets
-
- Target 2026-10-13_d86db419557e911776e779f66e92c74f_cobalt-strike_icedid_njrat_satacom_stealc
- Size 2.9MB
- SHA256 4ff6a72fcbcfab29742e377c615a6f8cabef364a1fbe7e21eaaf65371c41eaf1
Score9/10-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
-
Detects Windows executables referencing non-Windows User-Agents
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
-
Detects executables containing common artifacts observed in infostealers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
Modifies Windows Firewall
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Debugger Evasion
1Impair Defenses
1Disable or Modify System Firewall
1