2026-06-26_66b1a81c0bbdec799f2a554abacc5f66_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-26_66b1a81c0bbdec799f2a554abacc5f66_cobalt-strike_icedid_njrat_satacom_stealc
Size 367KB
Sample260629-st5jmsgw9t
SHA256 e4c664a2401b6773f47b293fad70962ed6356dcd3cc2253c902876d1b4f7cc63
MD5 66b1a81c0bbdec799f2a554abacc5f66
SHA1 26a2664018526eaf2264b16fbc7003a8c9f12ff8
SHA512 2888d832ae3f606540b69054c2c09a0ba3c4dd444202f44b2ab2a5cbff03540edd89c70e2aa79a0b727524e9b068741332720e2265247d911e78bf36e8ca898a
SSDEEP 6144:SqcQygZsaHW6aAProAqGqN1smHWnac5xgm85qsXfj/Euj0nstoCht1w:XbsUPOHWnEm8wsL
TLSH
T142847D15EBA404FDE277D178C9624902EB727C8E0370AADF23904A961F276E45E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-26_66b1a81c0bbdec799f2a554abacc5f66_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-06-26_66b1a81c0bbdec799f2a554abacc5f66_cobalt-strike_icedid_njrat_satacom_stealc

.exe 367KB

2026-06-26_66b1a81c0bbdec799f2a554abacc5f66_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH eab01cde41ee771d849994bcf8167879
SHA256 e4c664a2401b6773f47b293fad70962ed6356dcd3cc2253c902876d1b4f7cc63
MD5 66b1a81c0bbdec799f2a554abacc5f66
SHA1 26a2664018526eaf2264b16fbc7003a8c9f12ff8
SHA512 2888d832ae3f606540b69054c2c09a0ba3c4dd444202f44b2ab2a5cbff03540edd89c70e2aa79a0b727524e9b068741332720e2265247d911e78bf36e8ca898a
SSDEEP 6144:SqcQygZsaHW6aAProAqGqN1smHWnac5xgm85qsXfj/Euj0nstoCht1w:XbsUPOHWnEm8wsL
TLSH
T142847D15EBA404FDE277D178C9624902EB727C8E0370AADF23904A961F276E45E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

118064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetDC ReleaseDC GetSystemMetrics

gdi32

SelectObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteObject GetDIBits

winhttp

WinHttpQueryDataAvailable WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReceiveResponse WinHttpReadData WinHttpOpenRequest WinHttpSendRequest

crypt32

CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptGenerateSymmetricKey BCryptDecrypt

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA GetUserNameA RegEnumKeyA

iphlpapi

GetAdaptersAddresses

kernel32

FindFirstFileExW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx SetStdHandle GetProcessHeap CreateFileW HeapSize WriteConsoleW SetEndOfFile GetStartupInfoW GetEnvironmentVariableW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW GetTempPathW GlobalMemoryStatusEx LocalFree CopyFileW GetComputerNameA MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter RtlUnwind GetModuleHandleW GetFileSizeEx RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile

Name

.text

Size

257KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-26_66b1a81c0bbdec799f2a554abacc5f66_cobalt-strike_icedid_njrat_satacom_stealc

user32

gdi32

winhttp

crypt32

bcrypt

advapi32

iphlpapi

kernel32

generic