2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc
Size 998KB
Sample260704-1lnvxset3v
SHA256 aa163a59fed1ff707ec4b79114db4d834dc83be887fc834039e64d36013941af
MD5 d44e606058ec908b3c0437ff4aa4427d
SHA1 bc036c9aaaa6bdbd562b9ef64b5214794b876ff2
SHA512 8b2cc373e8d226ef03096730c7c3d2e4eb3a04c733d0015250cbc0ea84d363058a20790e96256a5efb8cc25f6eef3018ba3a0be6312ce3b561d032adf17dab50
SSDEEP 12288:z3gYcPF7ROrgV5c6P1b9ukXx2RV1Jp30pyuCJCotMilaHAW1tIN+309Psy+tVI:bQ7pV5c29uSA5Jp9LjMlH/XzyYq
TLSH
T10D259F1AE3A800FDD437C274CD665607EBB2B41623309ACBA7D59E562F23A716E3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc

.exe 998KB

2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 5f067526f0febb140dcb171c53655655
SHA256 aa163a59fed1ff707ec4b79114db4d834dc83be887fc834039e64d36013941af
MD5 d44e606058ec908b3c0437ff4aa4427d
SHA1 bc036c9aaaa6bdbd562b9ef64b5214794b876ff2
SHA512 8b2cc373e8d226ef03096730c7c3d2e4eb3a04c733d0015250cbc0ea84d363058a20790e96256a5efb8cc25f6eef3018ba3a0be6312ce3b561d032adf17dab50
SSDEEP 12288:z3gYcPF7ROrgV5c6P1b9ukXx2RV1Jp30pyuCJCotMilaHAW1tIN+309Psy+tVI:bQ7pV5c29uSA5Jp9LjMlH/XzyYq
TLSH
T10D259F1AE3A800FDD437C274CD665607EBB2B41623309ACBA7D59E562F23A716E3D311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

686048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

EnumDisplayDevicesA EnumDisplaySettingsA GetSystemMetrics ShowWindow

kernel32

GetConsoleOutputCP GetStringTypeW SetStdHandle GetEnvironmentStrings FreeEnvironmentStringsA GetEnvironmentVariableA ExpandEnvironmentStringsA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA GetFileAttributesW GetFileSizeEx GetLogicalDrives ReadFile GetTempPathA GetVolumeInformationA GetTempFileNameA CloseHandle GetLastError Sleep GlobalMemoryStatusEx GetSystemInfo GetTickCount FreeLibrary GetProcAddress LoadLibraryA LocalFree CopyFileA GetComputerNameA MultiByteToWideChar GetLocaleInfoA FreeConsole GetConsoleWindow FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte WriteConsoleW GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW WaitForSingleObjectEx FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetDiskFreeSpaceA FormatMessageW HeapSize HeapValidate UnmapViewOfFile CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection SystemTimeToFileTime GetCurrentThreadId SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetTimeZoneInformation LCMapStringW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW InitializeSListHead RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx DuplicateHandle GetCurrentProcess CreateProcessW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess TerminateProcess GetModuleFileNameW GetStdHandle IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetConsoleMode ReadConsoleW SetFilePointerEx GetFileType GetExitCodeProcess CreatePipe VirtualProtect LoadLibraryExW CompareStringW

advapi32

GetUserNameA

ole32

CreateStreamOnHGlobal

gdiplus

GdipCloneImage GdipDisposeImage GdiplusStartup GdipFree GdipAlloc GdipGetImageEncoders GdiplusShutdown GdipSaveImageToStream GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize

ws2_32

inet_ntop freeaddrinfo getaddrinfo

Name

CODE

Size

798KB

Virtual Size

798KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

IDATA

Size

20KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

RDATA

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

EDATA

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PCODE

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PDATA

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-04_d44e606058ec908b3c0437ff4aa4427d_cobalt-strike_icedid_njrat_satacom_stealc

user32

kernel32

advapi32

ole32

gdiplus

ws2_32

generic