2026-06-27_9cad65fc173a92eff10cf4fb559a5c2f_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_9cad65fc173a92eff10cf4fb559a5c2f_cobalt-strike_icedid_njrat_satacom_stealc
Size 690KB
Sample260629-e9wd1sev3q
SHA256 6576ce1d853bce75bd1e75c8ac8d46f322da817fabdcae3dc115cdeb5ad09ea2
MD5 9cad65fc173a92eff10cf4fb559a5c2f
SHA1 c75d1591fe5e1eb2c7ed35bc6653624a76b29ea2
SHA512 bc4514157b6e369196932d6a4d72d1f5671e00fbfe1fc771c07ddfa88bd4415c3c69c70578bcfc7a34aab486862363a8ed0b3732fb9e5eb8308bc709aa1e603c
SSDEEP 12288:3CGpZrWt/ecrNnJ4BTJonlrCy3GHWsUs6/n/5jy44lM+WD8rgI4cKGedihyg4bn0:3CGpZrWt/eaNnJ4BTJonlrCy22sUs6/W
TLSH
T1E4E45B26A66C01FCE1B7C1788D525902F6F57C8B03719FEF13901DB61E1B6D4AA7AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-27_9cad65fc173a92eff10cf4fb559a5c2f_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-06-27_9cad65fc173a92eff10cf4fb559a5c2f_cobalt-strike_icedid_njrat_satacom_stealc

.exe 690KB

2026-06-27_9cad65fc173a92eff10cf4fb559a5c2f_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 2fb08dd91b341cccbb0833307041cbe8
SHA256 6576ce1d853bce75bd1e75c8ac8d46f322da817fabdcae3dc115cdeb5ad09ea2
MD5 9cad65fc173a92eff10cf4fb559a5c2f
SHA1 c75d1591fe5e1eb2c7ed35bc6653624a76b29ea2
SHA512 bc4514157b6e369196932d6a4d72d1f5671e00fbfe1fc771c07ddfa88bd4415c3c69c70578bcfc7a34aab486862363a8ed0b3732fb9e5eb8308bc709aa1e603c
SSDEEP 12288:3CGpZrWt/ecrNnJ4BTJonlrCy3GHWsUs6/n/5jy44lM+WD8rgI4cKGedihyg4bn0:3CGpZrWt/eaNnJ4BTJonlrCy22sUs6/W
TLSH
T1E4E45B26A66C01FCE1B7C1788D525902F6F57C8B03719FEF13901DB61E1B6D4AA7AB20
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

329872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxA

kernel32

VirtualProtect GetCurrentProcess ExpandEnvironmentStringsA GetModuleHandleA GetProcAddress SetProcessWorkingSetSize VirtualFree VirtualAlloc GetCurrentThreadId GetModuleFileNameW GetTempPathW LoadLibraryA GetLastError GetCurrentProcessId WaitForSingleObject DeleteFileW CreateProcessW GetExitCodeProcess GetModuleHandleW WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW CloseHandle MultiByteToWideChar CreateFileW DeviceIoControl SetConsoleCursorPosition SetConsoleOutputCP SetConsoleCursorInfo GetConsoleMode Sleep SetConsoleWindowInfo SetCurrentConsoleFontEx GetConsoleCursorInfo SetConsoleMode SetConsoleScreenBufferSize SetConsoleTitleA GetConsoleScreenBufferInfo GetStdHandle SetConsoleTextAttribute SetEndOfFile GetEnvironmentStringsW FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadFile GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileAttributesExW QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW RtlUnwind EncodePointer DecodePointer LocalFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WideCharToMultiByte LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetConsoleCP FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent ExitProcess TerminateProcess WriteFile GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetTimeZoneInformation ReadConsoleInputW ReadConsoleW

ntdll

NtUnloadDriver NtQuerySystemInformation RtlAdjustPrivilege RtlInitUnicodeString NtLoadDriver

advapi32

CreateServiceW CloseServiceHandle OpenSCManagerW DeleteService ControlService StartServiceW OpenServiceW QueryServiceStatusEx RegSetKeyValueW RegCloseKey RegDeleteTreeW RegCreateKeyW RegOpenKeyW AllocateAndInitializeSid FreeSid CheckTokenMembership LookupPrivilegeValueW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

ole32

CoInitializeEx CoCreateInstance CoInitializeSecurity

oleaut32

SafeArrayDestroy VariantInit SafeArrayGetUBound SafeArrayGetElement SafeArrayGetLBound SysFreeString SysAllocString VariantClear

Name

.text

Size

488KB

Virtual Size

487KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

176KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_9cad65fc173a92eff10cf4fb559a5c2f_cobalt-strike_icedid_njrat_satacom_stealc

user32

kernel32

ntdll

advapi32

ole32

oleaut32

generic