2026-05-22_111e426eaeea20bc674892297fb8dc97_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-05-22_111e426eaeea20bc674892297fb8dc97_cobalt-strike_icedid_njrat_satacom_stealc
Size 3.5MB
Sample260522-3efbbaax41
SHA256 5adb9ce2947420b6fdb45ee5d22b031e35dd6eccdaea1f96a71a4847bce20bb5
MD5 111e426eaeea20bc674892297fb8dc97
SHA1 cdd8bc29e3589e68f39a0bb9284596ba69459b68
SHA512 ef2401fb47c24da80d5edd08a80e1d89c3ff3ea15c3dc221d50817d360499e9751e9956670463d95a4c5006711ed2ee9540c73ff3d97140f6d6809425c666563
SSDEEP 49152:t8SLWK6oNbSHLzCvj7gI/Tcc2gahyHWfisA9gfxrbKyNLKSgkn0OsSiyP7eQ:1WmN8Cvj7gI/Tcx49IxrmbSgknHIyT
TLSH
T1D8F50272A1109439F1474A38266F5AE76FF0E32A335ACACF12FC5B579E84CC505B928D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-22_111e426eaeea20bc674892297fb8dc97_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-05-22_111e426eaeea20bc674892297fb8dc97_cobalt-strike_icedid_njrat_satacom_stealc

.exe 3.5MB

2026-05-22_111e426eaeea20bc674892297fb8dc97_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH f8a11535b6bb5a14c2468abf72182eaa
SHA256 5adb9ce2947420b6fdb45ee5d22b031e35dd6eccdaea1f96a71a4847bce20bb5
MD5 111e426eaeea20bc674892297fb8dc97
SHA1 cdd8bc29e3589e68f39a0bb9284596ba69459b68
SHA512 ef2401fb47c24da80d5edd08a80e1d89c3ff3ea15c3dc221d50817d360499e9751e9956670463d95a4c5006711ed2ee9540c73ff3d97140f6d6809425c666563
SSDEEP 49152:t8SLWK6oNbSHLzCvj7gI/Tcc2gahyHWfisA9gfxrbKyNLKSgkn0OsSiyP7eQ:1WmN8Cvj7gI/Tcx49IxrmbSgknHIyT
TLSH
T1D8F50272A1109439F1474A38266F5AE76FF0E32A335ACACF12FC5B579E84CC505B928D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

10272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileA DeleteFileA GetFileAttributesA GetFileSize ReadFile WriteFile GetTempPathA CloseHandle QueryPerformanceCounter WaitForSingleObject Sleep GetCurrentProcessId GetExitCodeProcess CreateProcessA GetTickCount64 GetModuleFileNameA MoveFileExA GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW WriteConsoleW RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer GetStdHandle GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode CreateFileW

Name

ffptvqtd

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

mawdsbxx

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

udjxniuj

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

fstcnnpk

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

tycgsgsc

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

qxwjhyar

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

lajhwtms

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-22_111e426eaeea20bc674892297fb8dc97_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

generic