2026-05-28_4afef7294611cc72cefffcba13b3369f_cobalt-strike_icedid_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-28_4afef7294611cc72cefffcba13b3369f_cobalt-strike_icedid_satacom_stealc
Size 286KB
Sample260528-cble2sds2r
SHA256 bd4704e4592a96cdd150f7cbede5d10468958e10529214017bafe35d045942bd
MD5 4afef7294611cc72cefffcba13b3369f
SHA1 1c61bb27e983946d988a5f2e87c45412df8f5c4d
SHA512 c3e9a91347e0dd66c98679efe13b1420fd07957e50f1e8a12918627b4fe69b4c0bd6227ffd37298f3e136f223da950c468d8cd2e5777766e01b2fa8b34f59826
SSDEEP 6144:5ZhIZH+d5+xG/krOAMYTMVmPl8fKeLWvx:5Zyevt/IMo84l2Keivx
TLSH
T1B2548D1AB36918F9EEA7C57DCD520901DB72BC4647A1EACF03E04AA62F136D05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_4afef7294611cc72cefffcba13b3369f_cobalt-strike_icedid_satacom_stealc

File Explorer

2026-05-28_4afef7294611cc72cefffcba13b3369f_cobalt-strike_icedid_satacom_stealc

.exe 286KB

2026-05-28_4afef7294611cc72cefffcba13b3369f_cobalt-strike_icedid_satacom_stealc

IMPHASH 809984f11497f1dd2364144e482970e4
SHA256 bd4704e4592a96cdd150f7cbede5d10468958e10529214017bafe35d045942bd
MD5 4afef7294611cc72cefffcba13b3369f
SHA1 1c61bb27e983946d988a5f2e87c45412df8f5c4d
SHA512 c3e9a91347e0dd66c98679efe13b1420fd07957e50f1e8a12918627b4fe69b4c0bd6227ffd37298f3e136f223da950c468d8cd2e5777766e01b2fa8b34f59826
SSDEEP 6144:5ZhIZH+d5+xG/krOAMYTMVmPl8fKeLWvx:5Zyevt/IMo84l2Keivx
TLSH
T1B2548D1AB36918F9EEA7C57DCD520901DB72BC4647A1EACF03E04AA62F136D05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing combination of virtualization drivers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\xyz\Desktop\ALL\ALL\zeibase\zeibase\zeibase\bin\Release\SOg.pdb

kernel32

CloseHandle GetProcAddress CreateProcessA IsDebuggerPresent SetConsoleTextAttribute SetConsoleTitleA SetConsoleScreenBufferSize GetStdHandle SetConsoleWindowInfo GetConsoleWindow SetEndOfFile WriteConsoleW HeapSize SetStdHandle Sleep WaitForSingleObject GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc CreatePipe CreateFileW GetCurrentProcess GetExitCodeProcess ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID FormatMessageA WideCharToMultiByte LocalFree GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx MultiByteToWideChar QueryPerformanceCounter GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW DuplicateHandle CreateProcessW CreateThread ExitThread FreeLibraryAndExitThread IsProcessorFeaturePresent GetModuleFileNameW WriteFile GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale RtlUnwind

user32

GetWindowLongW SetWindowLongW MessageBoxA

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

shell32

ShellExecuteA

wininet

InternetOpenA InternetCloseHandle InternetReadFile InternetOpenUrlA

Name

.text

Size

187KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_4afef7294611cc72cefffcba13b3369f_cobalt-strike_icedid_satacom_stealc

kernel32

user32

advapi32

shell32

wininet

generic