2026-06-27_2648f127c3bc671eb47d1b103034ff40_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-06-27_2648f127c3bc671eb47d1b103034ff40_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.2MB
Sample260629-k4mskshx2t
SHA256 3277ace1a79a191980c951d767ee595a4c583ab372d33b1d4cd0ec949f909fd4
MD5 2648f127c3bc671eb47d1b103034ff40
SHA1 31a22e904988da754f2ae683fe16752dc835117f
SHA512 9fda80e25bcf1a65427a7f41b8beba5582f4dc93d69e7311e0263dac97717393fe8610f543368267d657ae1dd774c9d7df615467c72963e92435ae75450327b4
SSDEEP 24576:bDhW6nbuUm38cbtdvAfafSxWvr57k8ad511CC2r+nupn:bD46KUMJ9fdD54RAC2r+n8
TLSH
T18755D04272D525F9E177C6B888614A06E776BC250730ABDF03A072661F73AC19E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-27_2648f127c3bc671eb47d1b103034ff40_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-06-27_2648f127c3bc671eb47d1b103034ff40_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.2MB

2026-06-27_2648f127c3bc671eb47d1b103034ff40_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH fc95be45dfd7206f2d00769f3fe2fecb
SHA256 3277ace1a79a191980c951d767ee595a4c583ab372d33b1d4cd0ec949f909fd4
MD5 2648f127c3bc671eb47d1b103034ff40
SHA1 31a22e904988da754f2ae683fe16752dc835117f
SHA512 9fda80e25bcf1a65427a7f41b8beba5582f4dc93d69e7311e0263dac97717393fe8610f543368267d657ae1dd774c9d7df615467c72963e92435ae75450327b4
SSDEEP 24576:bDhW6nbuUm38cbtdvAfafSxWvr57k8ad511CC2r+nupn:bD46KUMJ9fdD54RAC2r+n8
TLSH
T18755D04272D525F9E177C6B888614A06E776BC250730ABDF03A072661F73AC19E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxW wsprintfW

kernel32

GetStdHandle WriteConsoleW CreateDirectoryW CreateFileW DeleteFileW GetFileSizeEx ReadFile RemoveDirectoryW SetFilePointerEx WriteFile GetTempPathW CloseHandle HeapAlloc HeapFree GetProcessHeap WaitForMultipleObjects GetCurrentProcessId ExitProcess GetExitCodeProcess CreateProcessW GetModuleFileNameW MultiByteToWideChar GetConsoleMode QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCurrentProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP

Name

.text

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_2648f127c3bc671eb47d1b103034ff40_cobalt-strike_icedid_njrat_satacom_stealc

user32

kernel32

generic