2026-07-02_b296248e4dc69c9bf5adcc3803327e8b_cobalt-strike_icedid_satacom

General

Target
2026-07-02_b296248e4dc69c9bf5adcc3803327e8b_cobalt-strike_icedid_satacom
Size 2.7MB
Sample260702-ch9ffshv6p
SHA256 ff00690741f6c5ab3ca52a0cbbb007dab3a477ed76684d2d94314963f9ca225e
MD5 b296248e4dc69c9bf5adcc3803327e8b
SHA1 47f0182b0aeb281beee70f742aa8d1668c3d9e11
SHA512 12edd2745b62df399206277245ec0d1363052410015b74ca59de8ba684841337cdb6099c5335661dd304bb866637a16d4862ed8f743995d2878cbc85e3bbf4f9
SSDEEP 49152:PZ1vWwcSCbJPaYtjHPz0I9Ldb2s7Fnc31RlRM1n68FNP4d0J:x9sfJC2TPz0I1lPclRHCP4WJ
TLSH
T14BD52387E98425B9D67345B33952C7C2F3BDF27A768E4A2450F4409A7D13AE94F223B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_b296248e4dc69c9bf5adcc3803327e8b_cobalt-strike_icedid_satacom

File Explorer

2026-07-02_b296248e4dc69c9bf5adcc3803327e8b_cobalt-strike_icedid_satacom

.exe 2.7MB

2026-07-02_b296248e4dc69c9bf5adcc3803327e8b_cobalt-strike_icedid_satacom

IMPHASH 39ff8f81df7958999fc2d4a9bf71c094
SHA256 ff00690741f6c5ab3ca52a0cbbb007dab3a477ed76684d2d94314963f9ca225e
MD5 b296248e4dc69c9bf5adcc3803327e8b
SHA1 47f0182b0aeb281beee70f742aa8d1668c3d9e11
SHA512 12edd2745b62df399206277245ec0d1363052410015b74ca59de8ba684841337cdb6099c5335661dd304bb866637a16d4862ed8f743995d2878cbc85e3bbf4f9
SSDEEP 49152:PZ1vWwcSCbJPaYtjHPz0I9Ldb2s7Fnc31RlRM1n68FNP4d0J:x9sfJC2TPz0I1lPclRHCP4WJ
TLSH
T14BD52387E98425B9D67345B33952C7C2F3BDF27A768E4A2450F4409A7D13AE94F223B0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

17852

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCreateKeyExW GetUserNameA RegCloseKey RegSetValueExW

shell32

SHGetFolderPathA SHGetFolderPathW

kernel32

WriteConsoleW SetFilePointerEx ReadFile GetModuleFileNameA HeapFree GetCurrentProcess lstrlenW WriteFile SetFileTime GetModuleFileNameW SetEnvironmentVariableW SetErrorMode SetFilePointer GetTempPathW lstrlenA GetEnvironmentVariableA CreateFileW CreateToolhelp32Snapshot MultiByteToWideChar Sleep CopyFileA GetFileAttributesA Process32NextW CreateFileA GetSystemDirectoryA LoadLibraryA DeleteFileA DeleteFileW lstrcpyA Process32FirstW CloseHandle GetSystemInfo HeapAlloc SetFileAttributesA GetFileSize SetEnvironmentVariableA GetProcessHeap SystemTimeToFileTime GlobalMemoryStatusEx FreeLibrary WideCharToMultiByte lstrcmpiA GetTempFileNameW CreateDirectoryA GetTickCount SetDllDirectoryW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle ExitProcess TerminateProcess GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW HeapSize

user32

GetSystemMetrics wsprintfW wsprintfA

Name

.text

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

110KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_b296248e4dc69c9bf5adcc3803327e8b_cobalt-strike_icedid_satacom

advapi32

shell32

kernel32

user32

generic