General
- Target 2026-10-22_cf98485c58eb7e7f13e3f6491a3e76bf_cobalt-strike_icedid_njrat_satacom_stealc
- Size 1.7MB
- Sample261023-ymmcdavs6l
- SHA256 0fc8eac62e715e0911195bb09f349241e0b2be3585a707ddab3f7c9aa56f6d0c
- MD5 cf98485c58eb7e7f13e3f6491a3e76bf
- SHA1 fbd68ec7f06363800f005d06f08f8a8334a9e00a
- SHA512 6fabeec28371b392ae868552f0482f4b76906ea78065a8c9becd196d00ca002fe0d600628522b96b7e641f595597624040736ed7c5c37dfdad302b498e8200ee
- SSDEEP 49152:dDVAFNdS+5rK0Zx+0a5X/oFFTBjT9E5MpsvnR1P6:dyDTZ05X/qFNeSyna
- TLSH T11085F11195A401BED273E3B9DD67880AEAB7784A13719EDF03C0F5B61F225D44A3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_cf98485c58eb7e7f13e3f6491a3e76bf_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_cf98485c58eb7e7f13e3f6491a3e76bf_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-10-22_cf98485c58eb7e7f13e3f6491a3e76bf_cobalt-strike_icedid_njrat_satacom_stealc
- Size 1.7MB
- SHA256 0fc8eac62e715e0911195bb09f349241e0b2be3585a707ddab3f7c9aa56f6d0c
- MD5 cf98485c58eb7e7f13e3f6491a3e76bf
- SHA1 fbd68ec7f06363800f005d06f08f8a8334a9e00a
- SHA512 6fabeec28371b392ae868552f0482f4b76906ea78065a8c9becd196d00ca002fe0d600628522b96b7e641f595597624040736ed7c5c37dfdad302b498e8200ee
- SSDEEP 49152:dDVAFNdS+5rK0Zx+0a5X/oFFTBjT9E5MpsvnR1P6:dyDTZ05X/qFNeSyna
- TLSH T11085F11195A401BED273E3B9DD67880AEAB7784A13719EDF03C0F5B61F225D44A3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score8/10-
Downloads MZ/PE file
-
Executes dropped EXE
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext