2026-06-28_c858d6021d311d65a759d1b8cc198d6e_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-28_c858d6021d311d65a759d1b8cc198d6e_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.6MB
Sample260628-xt97cab18x
SHA256 d5d4e505d5252adf97d3f00ab37001dcd59845daf979f6590f5566036503ed8c
MD5 c858d6021d311d65a759d1b8cc198d6e
SHA1 6abb72b699fda42c2fdbcfed6c46cbd53b6665ca
SHA512 9acc78295d08e1957f80cae93c6f4cfa5c6751598e07e9caa62423bf65162be42a99ebdefee0439c5ceca37b7e59272a6fdb9fc822b58412b289c2029e7dcf58
SSDEEP 24576:21QI67KScbbRIbrDAm1XmhjX5IsogsX+D+DOxW4n3nsKZ+aIuN:kQ/7KLJIbrDdIT5xlnMuN
TLSH
T1EE85AE05B2A442E8C17A95788886D63AEB327C151F2096CF23F05E673F676E05F7B391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_c858d6021d311d65a759d1b8cc198d6e_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-06-28_c858d6021d311d65a759d1b8cc198d6e_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.6MB

2026-06-28_c858d6021d311d65a759d1b8cc198d6e_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH f3d52bfab3c62bb0b5e1c9c9ada31fa8
SHA256 d5d4e505d5252adf97d3f00ab37001dcd59845daf979f6590f5566036503ed8c
MD5 c858d6021d311d65a759d1b8cc198d6e
SHA1 6abb72b699fda42c2fdbcfed6c46cbd53b6665ca
SHA512 9acc78295d08e1957f80cae93c6f4cfa5c6751598e07e9caa62423bf65162be42a99ebdefee0439c5ceca37b7e59272a6fdb9fc822b58412b289c2029e7dcf58
SSDEEP 24576:21QI67KScbbRIbrDAm1XmhjX5IsogsX+D+DOxW4n3nsKZ+aIuN:kQ/7KLJIbrDdIT5xlnMuN
TLSH
T1EE85AE05B2A442E8C17A95788886D63AEB327C151F2096CF23F05E673F676E05F7B391
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

552992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Selloz\Desktop\Carbonchecker\x64\Release\ConsoleApplication1.pdb

kernel32

GetEnvironmentVariableW GetModuleFileNameW MultiByteToWideChar GetTempPathW GetTempFileNameW GetVolumeInformationW GetLogicalDrives GetSystemTimes GetLogicalProcessorInformationEx GetDiskFreeSpaceExW GetSystemInfo GlobalMemoryStatusEx WideCharToMultiByte GetDriveTypeW GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter WriteConsoleW HeapSize GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage SetEndOfFile SetStdHandle GetConsoleOutputCP FlushFileBuffers HeapReAlloc GetFileSizeEx CreateDirectoryW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect CreatePipe HeapFree HeapAlloc GetProcAddress IsDebuggerPresent RtlVirtualUnwind LoadLibraryA CreateFileW DeviceIoControl CreateProcessW TerminateProcess SetConsoleMode GetStdHandle SetHandleInformation ReadFile RtlCaptureContext WriteFile ExitProcess IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread DeleteFileW GetCurrentProcess DuplicateHandle SetFilePointerEx GetFileType ReadConsoleW FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry LoadLibraryW GetModuleHandleW GetSystemFirmwareTable EnumSystemLocalesW FreeLibrary InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx RtlUnwind DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetExitCodeThread WaitForSingleObjectEx Sleep SleepConditionVariableSRW WakeAllConditionVariable CloseHandle GetConsoleMode WaitForSingleObject UnhandledExceptionFilter PeekNamedPipe SetConsoleOutputCP RaiseException GetCurrentThreadId GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockExclusive AcquireSRWLockExclusive

user32

GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode CloseClipboard EmptyClipboard GetClientRect GetClipboardData SetClipboardData DefWindowProcW DestroyWindow CreateWindowExW ScreenToClient GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW LoadIconW LoadCursorW PostQuitMessage PeekMessageW SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent OpenClipboard UpdateWindow TranslateMessage ClientToScreen GetKeyState GetMessageExtraInfo GetCapture

advapi32

RegEnumKeyExW RegQueryValueExW RegCloseKey RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ole32

CoCreateInstance CoSetProxyBlanket CoUninitialize CoInitializeEx CoInitializeSecurity

oleaut32

SafeArrayGetUBound SafeArrayGetLBound VariantClear SafeArrayAccessData SafeArrayUnaccessData SysAllocString SysFreeString VariantInit

iphlpapi

GetIfTable2 FreeMibTable GetIpNetTable2 GetAdaptersInfo

ws2_32

InetNtopW

rpcrt4

UuidCreateSequential

ntdll

NtDeviceIoControlFile NtCreateFile NtClose RtlPcToFileHeader

bthprops.cpl

BluetoothFindFirstRadio BluetoothGetRadioInfo BluetoothFindNextRadio BluetoothFindRadioClose

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

dxgi

CreateDXGIFactory

pdh

PdhGetFormattedCounterArrayW PdhAddCounterW PdhCloseQuery PdhOpenQueryW PdhCollectQueryData

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

736KB

Virtual Size

735KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

744KB

Virtual Size

743KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

156KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_c858d6021d311d65a759d1b8cc198d6e_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

ws2_32

rpcrt4

ntdll

bthprops.cpl

d3d11

dwmapi

dxgi

pdh

imm32

d3dcompiler_47

generic