2026-07-05_5573fb220b7e5a79e763f310985351ff_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_5573fb220b7e5a79e763f310985351ff_cobalt-strike_icedid_njrat_satacom_stealc
Size 978KB
Sample260705-3eepsags71
SHA256 0eff12d172edf791c5892e5412509ba82850d30103b4dc54c44ccc64494e696b
MD5 5573fb220b7e5a79e763f310985351ff
SHA1 4d8806df607bfe35d990d0773ecf72e4eadeeb49
SHA512 88e3c7496132f3e161b18dce200ba71b37de1f09876d9cab77c0f0b4f5236c24592d5098c1b194a7ba982016bc924c4d434f33e7b8c8062be83c8a75c1739ea9
SSDEEP 12288:GukvB8uuSD/CDQ+djh9tU76DtjE+WQ0Jn53pvPFeG0nrN7MIgSIO4JbQe09:dkOu9CDQmtUWZjzn0Jnn9Gnp7DfqQ
TLSH
T10D259F1AE3B940EDD837C178CD665607EFB2B41623309ACB57D48A962F23A715E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_5573fb220b7e5a79e763f310985351ff_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-05_5573fb220b7e5a79e763f310985351ff_cobalt-strike_icedid_njrat_satacom_stealc

.exe 978KB

2026-07-05_5573fb220b7e5a79e763f310985351ff_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH f92c88a0fc8c5e68c56923bdf9317b75
SHA256 0eff12d172edf791c5892e5412509ba82850d30103b4dc54c44ccc64494e696b
MD5 5573fb220b7e5a79e763f310985351ff
SHA1 4d8806df607bfe35d990d0773ecf72e4eadeeb49
SHA512 88e3c7496132f3e161b18dce200ba71b37de1f09876d9cab77c0f0b4f5236c24592d5098c1b194a7ba982016bc924c4d434f33e7b8c8062be83c8a75c1739ea9
SSDEEP 12288:GukvB8uuSD/CDQ+djh9tU76DtjE+WQ0Jn53pvPFeG0nrN7MIgSIO4JbQe09:dkOu9CDQmtUWZjzn0Jnn9Gnp7DfqQ
TLSH
T10D259F1AE3B940EDD837C178CD665607EFB2B41623309ACB57D48A962F23A715E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

679296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

EnumDisplayDevicesA EnumDisplaySettingsA GetSystemMetrics ShowWindow

kernel32

GetConsoleOutputCP GetStringTypeW SetStdHandle GetEnvironmentStrings FreeEnvironmentStringsA GetEnvironmentVariableA ExpandEnvironmentStringsA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesW GetFileSizeEx GetLogicalDrives ReadFile GetTempPathA GetVolumeInformationA GetTempFileNameA IsDebuggerPresent CloseHandle GetLastError Sleep ExitProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount FreeLibrary GetProcAddress LoadLibraryA LocalFree CopyFileA GetComputerNameA MultiByteToWideChar GetLocaleInfoA FreeConsole GetConsoleWindow FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime WriteConsoleW WideCharToMultiByte SystemTimeToFileTime GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW WaitForSingleObjectEx FlushViewOfFile OutputDebugStringW GetFileAttributesExW FormatMessageW HeapSize HeapValidate UnmapViewOfFile CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetCurrentThreadId GetSystemTimeAsFileTime TryEnterCriticalSection SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetTimeZoneInformation LCMapStringW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW InitializeSListHead RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx DuplicateHandle GetCurrentProcess CreateProcessW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW TerminateProcess GetModuleFileNameW GetStdHandle IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetConsoleMode ReadConsoleW SetFilePointerEx GetFileType GetExitCodeProcess CreatePipe VirtualProtect LoadLibraryExW CompareStringW

advapi32

GetUserNameA

ole32

CreateStreamOnHGlobal

gdiplus

GdipCloneImage GdipDisposeImage GdiplusStartup GdipFree GdipAlloc GdipGetImageEncoders GdiplusShutdown GdipSaveImageToStream GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize

ws2_32

inet_ntop freeaddrinfo getaddrinfo

Name

CODE

Size

787KB

Virtual Size

786KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

138KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

IDATA

Size

20KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

RDATA

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

EDATA

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PCODE

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PDATA

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_5573fb220b7e5a79e763f310985351ff_cobalt-strike_icedid_njrat_satacom_stealc

user32

kernel32

advapi32

ole32

gdiplus

ws2_32

generic