2026-07-03_7e6b3322c46e7e1ccf9f67e525c98a7b_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-07-03_7e6b3322c46e7e1ccf9f67e525c98a7b_cobalt-strike_icedid_njrat_satacom_stealc
Size 2.6MB
Sample260703-tc4fpact7v
SHA256 4e7e44ad3b267d5a9e223ac73805061cbbadaa7d9fde2bff3491933c76ecb795
MD5 7e6b3322c46e7e1ccf9f67e525c98a7b
SHA1 d93b86347920795d3347fa79eefac6325cc708c7
SHA512 1109ed264c3ed7b0a8e89ce5136bf18eabdd26dfa29cf8d211b08c7bc8a7c002b9b9b44cf75a3e78f9d984be1163582ee1984ede54105503494b23939d46b0f3
SSDEEP 49152:vsJuIYLlm1oq76ZB11zVXyLrfZf+n96K0A+PA1GnGmVtIwJkj3cBwy:8YhwrfZckK0AmnX75q3Awy
TLSH
T15CC50185B8F820F2C0A6D1BC85439911E637B4615771EECB47E08AD71E276E05F3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_7e6b3322c46e7e1ccf9f67e525c98a7b_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-03_7e6b3322c46e7e1ccf9f67e525c98a7b_cobalt-strike_icedid_njrat_satacom_stealc

.exe 2.6MB

2026-07-03_7e6b3322c46e7e1ccf9f67e525c98a7b_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 5959dcc289dadf14424cc27147dbf4a6
SHA256 4e7e44ad3b267d5a9e223ac73805061cbbadaa7d9fde2bff3491933c76ecb795
MD5 7e6b3322c46e7e1ccf9f67e525c98a7b
SHA1 d93b86347920795d3347fa79eefac6325cc708c7
SHA512 1109ed264c3ed7b0a8e89ce5136bf18eabdd26dfa29cf8d211b08c7bc8a7c002b9b9b44cf75a3e78f9d984be1163582ee1984ede54105503494b23939d46b0f3
SSDEEP 49152:vsJuIYLlm1oq76ZB11zVXyLrfZf+n96K0A+PA1GnGmVtIwJkj3cBwy:8YhwrfZckK0AmnX75q3Awy
TLSH
T15CC50185B8F820F2C0A6D1BC85439911E637B4615771EECB47E08AD71E276E05F3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

518336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

wsprintfW

advapi32

OpenProcessToken RegCloseKey RegEnumValueW RegDeleteValueW RegGetValueW RegOpenKeyExW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW

kernel32

GetSystemTimeAsFileTime SetEndOfFile HeapFree HeapCreate ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId QueryPerformanceCounter QueryPerformanceFrequency CloseHandle GetLastError WaitForSingleObjectEx GetExitCodeThread LocalFree FormatMessageA GetLocaleInfoEx WideCharToMultiByte FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar GetStringTypeW WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetCurrentProcessId RtlUnwind InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc GetFileType VirtualProtect LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap CreateFileW HeapSize WriteConsoleW

ole32

OleSetContainedObject CoCreateInstance OleUninitialize

Name

.text

Size

667KB

Virtual Size

666KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_7e6b3322c46e7e1ccf9f67e525c98a7b_cobalt-strike_icedid_njrat_satacom_stealc

user32

advapi32

kernel32

ole32

generic