2026-06-08_84df7faa0b50efe75a09132f3d54781f_cobalt-strike_icedid_njrat_satacom

General

Target
2026-06-08_84df7faa0b50efe75a09132f3d54781f_cobalt-strike_icedid_njrat_satacom
Size 438KB
Sample260608-3ebccsg14p
SHA256 59c20a85eaf4a7c1ebf4913d65efc5cd247fbc29420e48b54d48766bc6ffb332
MD5 84df7faa0b50efe75a09132f3d54781f
SHA1 654be5d2214987ac64f309eac491a4750752dc38
SHA512 87fa88ffc6ed64c3466a1119bd4e92fb448026bbc38532d85942deebbf5d31505bad6e5cb467ddc7dd1850da014b047684fc0da3a5bc8a2b428ded08f6c5a9e4
SSDEEP 6144:zTPmYiUGRIOhA6C9bLa1BxJEIlVxchA6C9bLa1BxJE:zTOXMOhfC9S1BxUhfC9S1Bx
TLSH
T11FA44A1AF7A610FBE573823CC9A30646EB72781557209BEF0354466A2F237D09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-08_84df7faa0b50efe75a09132f3d54781f_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-06-08_84df7faa0b50efe75a09132f3d54781f_cobalt-strike_icedid_njrat_satacom

.exe 438KB

2026-06-08_84df7faa0b50efe75a09132f3d54781f_cobalt-strike_icedid_njrat_satacom

IMPHASH 1b382c703e8dad00285539abb287642a
SHA256 59c20a85eaf4a7c1ebf4913d65efc5cd247fbc29420e48b54d48766bc6ffb332
MD5 84df7faa0b50efe75a09132f3d54781f
SHA1 654be5d2214987ac64f309eac491a4750752dc38
SHA512 87fa88ffc6ed64c3466a1119bd4e92fb448026bbc38532d85942deebbf5d31505bad6e5cb467ddc7dd1850da014b047684fc0da3a5bc8a2b428ded08f6c5a9e4
SSDEEP 6144:zTPmYiUGRIOhA6C9bLa1BxJEIlVxchA6C9bLa1BxJE:zTOXMOhfC9S1BxUhfC9S1Bx
TLSH
T11FA44A1AF7A610FBE573823CC9A30646EB72781557209BEF0354466A2F237D09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

serialver.exe.pdb

jli

JLI_Launch JLI_MemAlloc JLI_CmdToArgs JLI_GetStdArgc JLI_GetStdArgs JLI_MemFree JLI_InitArgProcessing

kernel32

GetCurrentProcessId SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry GetModuleHandleW GetCommandLineW WideCharToMultiByte QueryPerformanceCounter IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext

vcruntime140

__current_exception __current_exception_context memset memcpy __C_specific_handler

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __acrt_iob_func _set_fmode __p__commode

api-ms-win-crt-runtime-l1-1-0

perror _register_onexit_function exit __p___argc __p___argv _seh_filter_exe terminate _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _exit _initialize_onexit_table _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type _crt_atexit

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-08_84df7faa0b50efe75a09132f3d54781f_cobalt-strike_icedid_njrat_satacom

jli

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic