General
- Target 2026-11-03_c35a6c31182496d4c7d1d0d14318f0bf_cobalt-strike_icedid_njrat_satacom_stealc
- Size 327KB
- Sample261104-klen9abs7p
- SHA256 089e2de85178b06a256cef66b4aa7d110acadbd8f8a49a9d118a5879e726eb6a
- MD5 c35a6c31182496d4c7d1d0d14318f0bf
- SHA1 8b68ddd00b3025f805e5009fe683e6155c8552ba
- SHA512 5024fb4505ea889ef2f4265a57fcf0c8df5d85e7e5826365fbec8c42cfc0d3f8250ce4f63906a6c1bec208b353bf7129d875be7d0b617ba027b94da2e4dda286
- SSDEEP 6144:OH08iAZlzb5zTHHgx4hwdvUjgpTHPHEbXN6VeFaR6mc+B9b9y:aD9Tno4edjpTHPkb96AFaR6mc+BBA
- TLSH T179648D15F2A810F9E66781BCCE524506EB72BC560361E7DF23A04A972F277D09E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-03_c35a6c31182496d4c7d1d0d14318f0bf_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260911-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-03_c35a6c31182496d4c7d1d0d14318f0bf_cobalt-strike_icedid_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260911-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-11-03_c35a6c31182496d4c7d1d0d14318f0bf_cobalt-strike_icedid_njrat_satacom_stealc
- Size 327KB
- SHA256 089e2de85178b06a256cef66b4aa7d110acadbd8f8a49a9d118a5879e726eb6a
- MD5 c35a6c31182496d4c7d1d0d14318f0bf
- SHA1 8b68ddd00b3025f805e5009fe683e6155c8552ba
- SHA512 5024fb4505ea889ef2f4265a57fcf0c8df5d85e7e5826365fbec8c42cfc0d3f8250ce4f63906a6c1bec208b353bf7129d875be7d0b617ba027b94da2e4dda286
- SSDEEP 6144:OH08iAZlzb5zTHHgx4hwdvUjgpTHPHEbXN6VeFaR6mc+B9b9y:aD9Tno4edjpTHPkb96AFaR6mc+BBA
- TLSH T179648D15F2A810F9E66781BCCE524506EB72BC560361E7DF23A04A972F277D09E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Renames multiple (177) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.