2026-06-02_2e53df93ad71094041471f73d25d4f7b_cobalt-strike_icedid_satacom

General

Target
2026-06-02_2e53df93ad71094041471f73d25d4f7b_cobalt-strike_icedid_satacom
Size 121KB
Sample260602-cc3eyscw4l
SHA256 aef33b572ca9ab0896507f1861174d019b4f4287987f933353a2130f6b10cd93
MD5 2e53df93ad71094041471f73d25d4f7b
SHA1 d82e53de8190cc95a015837fe4278694b786cdda
SHA512 0bfb4b363f7e9ad61dded10ef731c5920e9a0c8abf40b908e25179d5b7eb0e20744070f6475a2f86465b4327335af767a0a08d789fd4e67711d50e26b295ee08
SSDEEP 3072:XpKQDo5sdc6imbNf9zvsAVvd1rALfhsDj6XXXX/XXXXXXXXXXXXXXXXXXXXXXXXB:Ajsdjzvssldem6XXXX/XXXXXXXXXXXXB
TLSH
T183C37B57B3A130F8E5779239C5848A4AD3B6F83547B09BEF03A846951F132E19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-02_2e53df93ad71094041471f73d25d4f7b_cobalt-strike_icedid_satacom

File Explorer

2026-06-02_2e53df93ad71094041471f73d25d4f7b_cobalt-strike_icedid_satacom

.exe 121KB

2026-06-02_2e53df93ad71094041471f73d25d4f7b_cobalt-strike_icedid_satacom

IMPHASH 08604a130b134640d360800953d54bf7
SHA256 aef33b572ca9ab0896507f1861174d019b4f4287987f933353a2130f6b10cd93
MD5 2e53df93ad71094041471f73d25d4f7b
SHA1 d82e53de8190cc95a015837fe4278694b786cdda
SHA512 0bfb4b363f7e9ad61dded10ef731c5920e9a0c8abf40b908e25179d5b7eb0e20744070f6475a2f86465b4327335af767a0a08d789fd4e67711d50e26b295ee08
SSDEEP 3072:XpKQDo5sdc6imbNf9zvsAVvd1rALfhsDj6XXXX/XXXXXXXXXXXXXXXXXXXXXXXXB:Ajsdjzvssldem6XXXX/XXXXXXXXXXXXB
TLSH
T183C37B57B3A130F8E5779239C5848A4AD3B6F83547B09BEF03A846951F132E19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

DeleteFileA GetTempPathA GetTempFileNameA Sleep WinExec WriteConsoleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent HeapFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter CloseHandle GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetProcessHeap FlushFileBuffers CreateFileW ReadFile ReadConsoleW HeapSize HeapReAlloc SetEndOfFile

Name

.text

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-02_2e53df93ad71094041471f73d25d4f7b_cobalt-strike_icedid_satacom

kernel32

generic