2026-05-17_a70b4dc40a69f2ec724a3a1ff17a9e82_cobalt-strike_icedid_satacom

General

Target
2026-05-17_a70b4dc40a69f2ec724a3a1ff17a9e82_cobalt-strike_icedid_satacom
Size 731KB
Sample260517-nc4tkabt5j
SHA256 4a3677aee4e64f6891c0a07993456db3d99e722c7f50ee755481d77eb5aad5ba
MD5 a70b4dc40a69f2ec724a3a1ff17a9e82
SHA1 5563a27b864679fb5e1aef2b6904f3baaf1f21d2
SHA512 05342605a9de571ddcecfe68b5507e34448808b0bfe6c7a9bb39b05d8ed5a9483fb3e1f443827a8c7dc9f974a08b72ebf8a744968d6a14c138782bfc4d9a61ba
SSDEEP 12288:QVc4iaw1kbJVSeRY1yduiFTSxKW1+AivOKp2W+0EUbB0mUVG0OxJ:QVc4LV7RkOxhW1QvOKp2F6BiVGx
TLSH
T1F8F41247A3EA70FDE1394A3C88548955E771B8350B225FEF03D0425A5F83AE94E3EB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-17_a70b4dc40a69f2ec724a3a1ff17a9e82_cobalt-strike_icedid_satacom

File Explorer

2026-05-17_a70b4dc40a69f2ec724a3a1ff17a9e82_cobalt-strike_icedid_satacom

.exe 731KB

2026-05-17_a70b4dc40a69f2ec724a3a1ff17a9e82_cobalt-strike_icedid_satacom

IMPHASH 045ef41203246c2941c2532a014c6846
SHA256 4a3677aee4e64f6891c0a07993456db3d99e722c7f50ee755481d77eb5aad5ba
MD5 a70b4dc40a69f2ec724a3a1ff17a9e82
SHA1 5563a27b864679fb5e1aef2b6904f3baaf1f21d2
SHA512 05342605a9de571ddcecfe68b5507e34448808b0bfe6c7a9bb39b05d8ed5a9483fb3e1f443827a8c7dc9f974a08b72ebf8a744968d6a14c138782bfc4d9a61ba
SSDEEP 12288:QVc4iaw1kbJVSeRY1yduiFTSxKW1+AivOKp2W+0EUbB0mUVG0OxJ:QVc4LV7RkOxhW1QvOKp2F6BiVGx
TLSH
T1F8F41247A3EA70FDE1394A3C88548955E771B8350B225FEF03D0425A5F83AE94E3EB16
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider

kernel32

WriteConsoleW CloseHandle CreateFileW SetFilePointerEx IsDebuggerPresent GetModuleHandleA GetProcAddress LoadLibraryA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent HeapFree HeapAlloc RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Name

.text

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

631KB

Virtual Size

633KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-17_a70b4dc40a69f2ec724a3a1ff17a9e82_cobalt-strike_icedid_satacom

bcrypt

kernel32

generic