0f3409edb4a451bb22941954ccf999cab23ea7e34342a08f2ba0d7c04511d5c8 | Triage™

Login
Reports

Overview

overview

Static

static

3

2026-10-26...om.exe

windows10-2004-x64

2026-10-26...om.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_5268d3ddb3e1a4ea9466de6af94074de_cobalt-strike_icedid_njrat_satacom
Size 206KB
Sample261027-v16rdsfx2l
SHA256 0f3409edb4a451bb22941954ccf999cab23ea7e34342a08f2ba0d7c04511d5c8
MD5 5268d3ddb3e1a4ea9466de6af94074de
SHA1 c0fa7f26dbdc82f25bb34df229119b16313490ab
SHA512 77dc01de7c64d3844c61e99b70ee117d32d2344981a278b5ebdda17bfc37c401ad07360db5a3663f07ab8222b7e641b58bfbcc05a11fbf0546a647acf766c483
SSDEEP 3072:Ma3HcQ/kxHqebQ8ZluBMyPZOCII0w3RdD6R+yamITv2ffKllS2yRZnac02AidBrj:Ma3Hcwkx6jmILVlj58AiPnMlhGqK
TLSH
T109248D59779784F5D8A3833DCA518687E9B138060720EFDF03748A62AF236E58D7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution privilege_escalation

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2026-10-26_5268d3ddb3e1a4ea9466de6af94074de_cobalt-strike_icedid_njrat_satacom.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

5 signatures

150 seconds

defense_evasion execution privilege_escalation

Behavioral task

behavioral2

Sample

2026-10-26_5268d3ddb3e1a4ea9466de6af94074de_cobalt-strike_icedid_njrat_satacom.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

5 signatures

150 seconds

defense_evasion execution privilege_escalation

Malware Config

Targets

- Target
  2026-10-26_5268d3ddb3e1a4ea9466de6af94074de_cobalt-strike_icedid_njrat_satacom
- Size 206KB
- SHA256 0f3409edb4a451bb22941954ccf999cab23ea7e34342a08f2ba0d7c04511d5c8
- MD5 5268d3ddb3e1a4ea9466de6af94074de
- SHA1 c0fa7f26dbdc82f25bb34df229119b16313490ab
- SHA512 77dc01de7c64d3844c61e99b70ee117d32d2344981a278b5ebdda17bfc37c401ad07360db5a3663f07ab8222b7e641b58bfbcc05a11fbf0546a647acf766c483
- SSDEEP 3072:Ma3HcQ/kxHqebQ8ZluBMyPZOCII0w3RdD6R+yamITv2ffKllS2yRZnac02AidBrj:Ma3Hcwkx6jmILVlj58AiPnMlhGqK
- TLSH
  T109248D59779784F5D8A3833DCA518687E9B138060720EFDF03748A62AF236E58D7E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution privilege_escalation
- Suspicious use of NtCreateUserProcessOtherParentProcess
  defense_evasion privilege_escalation
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Access Token Manipulation

Parent PID Spoofing

Defense Evasion

Access Token Manipulation

Parent PID Spoofing

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasionexecutionprivilege_escalation

behavioral2

defense_evasionexecutionprivilege_escalation

© 2018-2026

Terms | Privacy