2026-06-26_36641b980d994d2bcc4267016e4cc562_cobalt-strike_icedid_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-26_36641b980d994d2bcc4267016e4cc562_cobalt-strike_icedid_satacom_stealc
Size 170KB
Sample260629-vgajvaby6n
SHA256 42308fc634a67cef017d22b873e74de0183e8d20df1821ef8dc0e98bf967f335
MD5 36641b980d994d2bcc4267016e4cc562
SHA1 d164418ca8d75e0e4bff62916db89a651e649d27
SHA512 e9dfc585ae5e7ac84c93d93ce96f36ac9abd42836e4928da3a9e5703c6a6f98d73ca95972f21ebeedc7967c928abc1ed45542129b9dc7ce68007f6a43460abf6
SSDEEP 3072:5tG1K/SK31L0Bb0+Ty/XTR2BMLFrcfRYW1xOo:5c1KEF0+oj5WjF
TLSH
T1F2044C07A6AA70FAE2378534C5924A01FB3378714BA1EADF47504AB61E236D4DF3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-26_36641b980d994d2bcc4267016e4cc562_cobalt-strike_icedid_satacom_stealc

File Explorer

2026-06-26_36641b980d994d2bcc4267016e4cc562_cobalt-strike_icedid_satacom_stealc

.exe 170KB

2026-06-26_36641b980d994d2bcc4267016e4cc562_cobalt-strike_icedid_satacom_stealc

IMPHASH 0501aeb142459b694e3695ca632ca14c
SHA256 42308fc634a67cef017d22b873e74de0183e8d20df1821ef8dc0e98bf967f335
MD5 36641b980d994d2bcc4267016e4cc562
SHA1 d164418ca8d75e0e4bff62916db89a651e649d27
SHA512 e9dfc585ae5e7ac84c93d93ce96f36ac9abd42836e4928da3a9e5703c6a6f98d73ca95972f21ebeedc7967c928abc1ed45542129b9dc7ce68007f6a43460abf6
SSDEEP 3072:5tG1K/SK31L0Bb0+Ty/XTR2BMLFrcfRYW1xOo:5c1KEF0+oj5WjF
TLSH
T1F2044C07A6AA70FAE2378534C5924A01FB3378714BA1EADF47504AB61E236D4DF3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Andrew\source\repos\HyperVirus\x64\Release\HyperVirus.pdb

kernel32

GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA SetStdHandle GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx GetFileType GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc CreateFileW WriteConsoleW GetConsoleWindow CopyFileW GetModuleHandleW ExitProcess GetProcAddress CloseHandle Process32NextW Process32FirstW Sleep CreateToolhelp32Snapshot OpenProcess GetModuleHandleA GetSystemDirectoryW GetModuleFileNameW TerminateProcess GetCPInfo CreateDirectoryW GetCurrentThreadId GetLastError ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess GetStdHandle WriteFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW LCMapStringW

user32

DestroyWindow GetDC SetWindowPos DefWindowProcW GetMessageW EnumDisplayMonitors FillRect CreateWindowExW CallNextHookEx GetSystemMetrics MessageBeep MessageBoxW ShowWindow GetAsyncKeyState DispatchMessageW SetLayeredWindowAttributes TranslateMessage SetWindowsHookExW GetClientRect DrawTextW SystemParametersInfoW ShowCursor InvalidateRect ReleaseDC BeginPaint EndPaint RegisterClassExW

gdi32

BitBlt CreateCompatibleBitmap ModifyWorldTransform SelectObject CreateCompatibleDC SetGraphicsMode CreateFontW GetStockObject DeleteDC SetTextColor SetBkMode LineTo CreatePen MoveToEx DeleteObject CreateSolidBrush SetWorldTransform

advapi32

AllocateAndInitializeSid RegCreateKeyExW RegDeleteTreeW RegSetValueExW FreeSid CheckTokenMembership RegOpenKeyExW RegCloseKey

shell32

ShellExecuteW SHGetFolderPathW

msimg32

AlphaBlend

Name

.text

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-26_36641b980d994d2bcc4267016e4cc562_cobalt-strike_icedid_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

msimg32

generic