2026-07-05_482cdd17f7bf6953d147151c80312984_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_482cdd17f7bf6953d147151c80312984_cobalt-strike_icedid_njrat_satacom_stealc
Size 1001KB
Sample260705-3els4ab15p
SHA256 845e3257c6c0daf639dec82632de3b9af5482c346829cdd122596b0dec8961c6
MD5 482cdd17f7bf6953d147151c80312984
SHA1 9c2a49914fc7f131f4b2dd552297872c973fdb10
SHA512 6dedc3d831c0504eb24dfef47a3fa5461a398bc4363f99764e3418aa28d579c26cd4d7507863ab9c2b0b6b09d473b9c7f892def96c27bff9438961b7127c21dc
SSDEEP 24576:UVl8BSTH5bvtogYf+BJHbK2ezLOx4bINTgW:U3OSTplTYfCJHW2ee4cN
TLSH
T1DE259F1AE3A800FCD877C174CD665607EBB2B41623309ACB97D59E962F23A716E3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_482cdd17f7bf6953d147151c80312984_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-05_482cdd17f7bf6953d147151c80312984_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1001KB

2026-07-05_482cdd17f7bf6953d147151c80312984_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH f92c88a0fc8c5e68c56923bdf9317b75
SHA256 845e3257c6c0daf639dec82632de3b9af5482c346829cdd122596b0dec8961c6
MD5 482cdd17f7bf6953d147151c80312984
SHA1 9c2a49914fc7f131f4b2dd552297872c973fdb10
SHA512 6dedc3d831c0504eb24dfef47a3fa5461a398bc4363f99764e3418aa28d579c26cd4d7507863ab9c2b0b6b09d473b9c7f892def96c27bff9438961b7127c21dc
SSDEEP 24576:UVl8BSTH5bvtogYf+BJHbK2ezLOx4bINTgW:U3OSTplTYfCJHW2ee4cN
TLSH
T1DE259F1AE3A800FCD877C174CD665607EBB2B41623309ACB97D59E962F23A716E3D311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

687312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

EnumDisplayDevicesA EnumDisplaySettingsA GetSystemMetrics ShowWindow

kernel32

GetConsoleOutputCP GetStringTypeW SetStdHandle GetEnvironmentStrings FreeEnvironmentStringsA GetEnvironmentVariableA ExpandEnvironmentStringsA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesW GetFileSizeEx GetLogicalDrives ReadFile GetTempPathA GetVolumeInformationA GetTempFileNameA IsDebuggerPresent CloseHandle GetLastError Sleep ExitProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount FreeLibrary GetProcAddress LoadLibraryA LocalFree CopyFileA GetComputerNameA MultiByteToWideChar GetLocaleInfoA FreeConsole GetConsoleWindow FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime WriteConsoleW WideCharToMultiByte SystemTimeToFileTime GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW WaitForSingleObjectEx FlushViewOfFile OutputDebugStringW GetFileAttributesExW FormatMessageW HeapSize HeapValidate UnmapViewOfFile CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetCurrentThreadId GetSystemTimeAsFileTime TryEnterCriticalSection SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetTimeZoneInformation LCMapStringW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW InitializeSListHead RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx DuplicateHandle GetCurrentProcess CreateProcessW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW TerminateProcess GetModuleFileNameW GetStdHandle IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetConsoleMode ReadConsoleW SetFilePointerEx GetFileType GetExitCodeProcess CreatePipe VirtualProtect LoadLibraryExW CompareStringW

advapi32

GetUserNameA

ole32

CreateStreamOnHGlobal

gdiplus

GdipCloneImage GdipDisposeImage GdiplusStartup GdipFree GdipAlloc GdipGetImageEncoders GdiplusShutdown GdipSaveImageToStream GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize

ws2_32

inet_ntop freeaddrinfo getaddrinfo

Name

CODE

Size

800KB

Virtual Size

799KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

IDATA

Size

20KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

RDATA

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

EDATA

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PCODE

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PDATA

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_482cdd17f7bf6953d147151c80312984_cobalt-strike_icedid_njrat_satacom_stealc

user32

kernel32

advapi32

ole32

gdiplus

ws2_32

generic