2026-06-29_b5d581be8c366c77cafda260de161162_cobalt-strike_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-29_b5d581be8c366c77cafda260de161162_cobalt-strike_icedid_njrat_satacom
Size 180KB
Sample260630-e623dse16q
SHA256 5ebb58976aa189f936c12286d1ec3789a6f715fd5cc1326fae1df26bd5f3e5a8
MD5 b5d581be8c366c77cafda260de161162
SHA1 3bc63634bd40cafab3d922683aab3c1ef7301788
SHA512 a14612f1b51d8dca7a9aae3abcfb68eb721110121ec7773305e0b9d06b7af218fb5dfe2a0547abf4ca7174e59c0fcdc6def067d8eddff5c351a6e6d677de077d
SSDEEP 3072:2KK+vUCBZi6iUwXd2CNJTI8nFY9jTOLjhlOLlDxaoyMKn:ZUcML6cJTkBT4jvOLXaotKn
TLSH
T142048C5BB7A631F9E1729239C4A10646FBB2783117649BEF03A443661E233D09D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-29_b5d581be8c366c77cafda260de161162_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-06-29_b5d581be8c366c77cafda260de161162_cobalt-strike_icedid_njrat_satacom

.exe 180KB

2026-06-29_b5d581be8c366c77cafda260de161162_cobalt-strike_icedid_njrat_satacom

IMPHASH ebad320e8149a54a4c566c25b3b7de2a
SHA256 5ebb58976aa189f936c12286d1ec3789a6f715fd5cc1326fae1df26bd5f3e5a8
MD5 b5d581be8c366c77cafda260de161162
SHA1 3bc63634bd40cafab3d922683aab3c1ef7301788
SHA512 a14612f1b51d8dca7a9aae3abcfb68eb721110121ec7773305e0b9d06b7af218fb5dfe2a0547abf4ca7174e59c0fcdc6def067d8eddff5c351a6e6d677de077d
SSDEEP 3072:2KK+vUCBZi6iUwXd2CNJTI8nFY9jTOLjhlOLlDxaoyMKn:ZUcML6cJTkBT4jvOLXaotKn
TLSH
T142048C5BB7A631F9E1729239C4A10646FBB2783117649BEF03A443661E233D09D3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetCursorPos

crypt32

CryptStringToBinaryA

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptDecrypt BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptSetProperty

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

iphlpapi

GetAdaptersInfo

ole32

CoCreateGuid

kernel32

HeapReAlloc HeapSize GetConsoleMode CreateFileW WriteConsoleW FlushFileBuffers GetConsoleOutputCP EnterCriticalSection SetFilePointerEx CreateFileA DeleteFileA GetDiskFreeSpaceExA GetFileSize ReadFile SetFilePointer WriteFile GetTempPathA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle WaitForSingleObject Sleep GetCurrentProcess ExitProcess CreateProcessA GetTickCount GetTickCount64 GetModuleFileNameA GetModuleHandleA GetProcAddress MoveFileExA CreateToolhelp32Snapshot Process32First Process32Next QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW TerminateProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent HeapFree HeapAlloc RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap

Name

.text

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-29_b5d581be8c366c77cafda260de161162_cobalt-strike_icedid_njrat_satacom

user32

crypt32

bcrypt

advapi32

iphlpapi

ole32

kernel32

generic