2026-07-01_f6933d86507a936e2eba4e1462fe62b6_cobalt-strike_icedid_njrat_ryuk_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-01_f6933d86507a936e2eba4e1462fe62b6_cobalt-strike_icedid_njrat_ryuk_satacom
Size 1.2MB
Sample260701-hxesaaax4y
SHA256 5b2f004022730bd2c1f1a4ad56bbbd862bf252a18a0a029479cb51634c5d77b6
MD5 f6933d86507a936e2eba4e1462fe62b6
SHA1 68b36f042005a2b1580a5b8aa053b4d15974a344
SHA512 169bfe6a2161caf4388cd074698b555d24122fb5a79ed245b16c2ef2c0f6f0df1cf6056ed761e5ff6bc498f719e8645d0bcd43a683b997f99d3c0108a4a23487
SSDEEP 24576:Xi/bj9MmCY2rV2WyPQR23u/ohKL27jGaOlNnH/TBtf7Kc:CMJYmVAPQMNhoCDUNnfTBRKc
TLSH
T10855C016E2E640E9DC79C7388A766622EA7278015F34A5EF1295472A3F73F805F3DB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-01_f6933d86507a936e2eba4e1462fe62b6_cobalt-strike_icedid_njrat_ryuk_satacom

File Explorer

2026-07-01_f6933d86507a936e2eba4e1462fe62b6_cobalt-strike_icedid_njrat_ryuk_satacom

.exe 1.2MB

2026-07-01_f6933d86507a936e2eba4e1462fe62b6_cobalt-strike_icedid_njrat_ryuk_satacom

IMPHASH b7ed0681e2246e84088ec5c128fe3b78
SHA256 5b2f004022730bd2c1f1a4ad56bbbd862bf252a18a0a029479cb51634c5d77b6
MD5 f6933d86507a936e2eba4e1462fe62b6
SHA1 68b36f042005a2b1580a5b8aa053b4d15974a344
SHA512 169bfe6a2161caf4388cd074698b555d24122fb5a79ed245b16c2ef2c0f6f0df1cf6056ed761e5ff6bc498f719e8645d0bcd43a683b997f99d3c0108a4a23487
SSDEEP 24576:Xi/bj9MmCY2rV2WyPQR23u/ohKL27jGaOlNnH/TBtf7Kc:CMJYmVAPQMNhoCDUNnfTBRKc
TLSH
T10855C016E2E640E9DC79C7388A766622EA7278015F34A5EF1295472A3F73F805F3DB01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

485504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

DragAcceptFiles DragFinish DragQueryFileA ShellExecuteA ord71 Shell_NotifyIconW

advapi32

AdjustTokenPrivileges ChangeServiceConfigA CloseServiceHandle CloseTrace ControlService ControlTraceA ConvertSecurityDescriptorToStringSecurityDescriptorA ConvertStringSecurityDescriptorToSecurityDescriptorA CreateServiceA DeleteService EnableTraceEx2 GetUserNameW InitializeSecurityDescriptor LookupPrivilegeValueA OpenProcessToken OpenSCManagerA OpenServiceA OpenTraceA ProcessTrace RegCloseKey RegCreateKeyExA RegGetKeySecurity RegOpenKeyA RegOpenKeyExA RegQueryValueExA RegSetKeySecurity RegSetValueA RegSetValueExA RegisterServiceCtrlHandlerExA SetSecurityDescriptorDacl SetServiceStatus StartServiceA StartServiceCtrlDispatcherA StartTraceA SystemFunction036

user32

AttachThreadInput BringWindowToTop CheckDlgButton CloseClipboard CreateDialogIndirectParamW CreateWindowExW DialogBoxIndirectParamW DispatchMessageW EnableWindow EndDialog GetClassNameA GetClientRect GetClipboardData GetDlgItem GetDlgItemTextW GetForegroundWindow GetSubMenu GetSysColor GetSysColorBrush GetWindowLongPtrW GetWindowRect GetWindowTextW GetWindowThreadProcessId IsClipboardFormatAvailable IsDialogMessageW IsDlgButtonChecked LoadIconA LoadIconW LoadImageA LoadMenuIndirectW MapVirtualKeyExA MapWindowPoints MessageBoxTimeoutW MessageBoxW MoveWindow MsgWaitForMultipleObjects OpenClipboard PeekMessageW PostMessageW PostQuitMessage ScreenToClient SendMessageW SetClassLongPtrW SetDlgItemTextW SetFocus SetForegroundWindow SetTimer SetWindowLongPtrW SetWindowTextW ShowWindow TrackPopupMenu TranslateMessage

ntdll

NtQueryInformationProcess NtQueryVirtualMemory NtReadVirtualMemory NtResumeProcess NtSuspendProcess NtTerminateProcess NtUnmapViewOfSection RtlCaptureContext RtlCaptureStackBackTrace RtlCrc64 RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind

gdi32

DeleteObject SetBkColor SetTextColor

oleaut32

SysAllocString SysFreeString

ws2_32

WSAEnumProtocolsW WSAEventSelect WSAPoll WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname htons inet_addr listen recv send sendto setsockopt socket

dbghelp

SymGetSymFromAddr64 SymInitialize

ole32

CoAllowSetForegroundWindow CoCreateInstance CoInitialize CoInitializeEx CoInitializeSecurity CoUninitialize

tdh

TdhGetEventInformation

dinput8

DirectInput8Create

version

GetFileVersionInfoW VerQueryValueA

comctl32

InitCommonControlsEx

iphlpapi

GetTcpTable2 SetTcpEntry

wininet

HttpAddRequestHeadersA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetReadFile InternetSetOptionA

kernel32

AddVectoredExceptionHandler CloseHandle CompareStringW CopyFileA CreateDirectoryA CreateDirectoryExA CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreatePipe CreateProcessA CreateRemoteThread CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetExitCodeThread GetFileAttributesA GetFileAttributesExW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetStartupInfoA GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTimeZoneInformation GetUserDefaultUILanguage GlobalLock GlobalUnlock HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsBadWritePtr IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsWow64Process2 K32EnumProcessModulesEx K32EnumProcesses K32GetModuleFileNameExA LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree LockFile LockFileEx MapViewOfFile MapViewOfFileEx MoveFileA MoveFileExW MultiByteToWideChar OpenMutexA OpenProcess OutputDebugStringW Process32First Process32Next QueryFullProcessImageNameW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseMutex SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointer SetFilePointerEx SetLastError SetPriorityClass SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SignalObjectAndWait Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnlockFile UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQueryEx WaitForSingleObject WideCharToMultiByte Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WriteConsoleW WriteFile WriteProcessMemory

Name

.text

Size

643KB

Virtual Size

643KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

134KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

26.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

25B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

460KB

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-01_f6933d86507a936e2eba4e1462fe62b6_cobalt-strike_icedid_njrat_ryuk_satacom

shell32

advapi32

user32

ntdll

gdi32

oleaut32

ws2_32

dbghelp

ole32

tdh

dinput8

version

comctl32

iphlpapi

wininet

kernel32

generic