2026-07-05_30dcba692dab2244ad2836197608cecd_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_30dcba692dab2244ad2836197608cecd_cobalt-strike_icedid_njrat_satacom_stealc
Size 994KB
Sample260705-b6bcwsgt4s
SHA256 f85d6dfe6568023270948906d915b4eb952b26dc61a9b8cd149c071a24260272
MD5 30dcba692dab2244ad2836197608cecd
SHA1 02490a47d760dfc17fdcc09ec432c434083a5ff1
SHA512 bc8caf3997e47354b0e99ed305db689c0438cf43db5af1b4448680c6c6043a873bf76ae8c4cc12281f661fffa3ef946c5c102cd69f7e465e6d6a05423817eb49
SSDEEP 24576:xC8zCUGfCvM2rzVtJpPmpzhMIdKty8P1s:jzCX6RrzfJpOpWIYty8d
TLSH
T1DE259F1AE3B840ECD477C1B4CD665607EF72B41623309ACB97E49A962F23A715E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_30dcba692dab2244ad2836197608cecd_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-05_30dcba692dab2244ad2836197608cecd_cobalt-strike_icedid_njrat_satacom_stealc

.exe 994KB

2026-07-05_30dcba692dab2244ad2836197608cecd_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 8bb7648b51b61541f8aafbd6301b814a
SHA256 f85d6dfe6568023270948906d915b4eb952b26dc61a9b8cd149c071a24260272
MD5 30dcba692dab2244ad2836197608cecd
SHA1 02490a47d760dfc17fdcc09ec432c434083a5ff1
SHA512 bc8caf3997e47354b0e99ed305db689c0438cf43db5af1b4448680c6c6043a873bf76ae8c4cc12281f661fffa3ef946c5c102cd69f7e465e6d6a05423817eb49
SSDEEP 24576:xC8zCUGfCvM2rzVtJpPmpzhMIdKty8P1s:jzCX6RrzfJpOpWIYty8d
TLSH
T1DE259F1AE3B840ECD477C1B4CD665607EF72B41623309ACB97E49A962F23A715E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

683696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

EnumDisplayDevicesA EnumDisplaySettingsA ReleaseDC GetDC GetSystemMetrics ShowWindow

kernel32

FindFirstFileA FindNextFileA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesW GetFileSizeEx GetLogicalDrives ReadFile GetTempPathA GetVolumeInformationA GetTempFileNameA IsDebuggerPresent CloseHandle GetLastError Sleep GetCurrentProcessId ExitProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount FreeLibrary GetProcAddress LoadLibraryA LocalFree CopyFileA GetComputerNameA MultiByteToWideChar GetLocaleInfoA FreeConsole GetConsoleWindow FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc DeleteFileA HeapReAlloc DeleteFileW WaitForSingleObjectEx FlushViewOfFile OutputDebugStringW GetFileAttributesExW FormatMessageW HeapSize HeapValidate UnmapViewOfFile CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId GetEnvironmentStringsW CreateFileA ExpandEnvironmentStringsA GetEnvironmentVariableA FreeEnvironmentStringsA GetEnvironmentStrings FindClose GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetTimeZoneInformation FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW WriteConsoleW LoadLibraryW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW InitializeSListHead RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx DuplicateHandle GetCurrentProcess CreateProcessW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW TerminateProcess GetModuleFileNameW GetStdHandle IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetConsoleOutputCP GetConsoleMode ReadConsoleW SetFilePointerEx GetFileType GetExitCodeProcess CreatePipe

gdi32

SelectObject DeleteObject CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteDC

gdiplus

GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipSaveImageToStream GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipGetImageEncoders GdipDisposeImage

advapi32

RegQueryValueExA RegOpenKeyExA RegEnumValueA RegEnumKeyExA RegCloseKey GetUserNameA

ole32

CreateStreamOnHGlobal

ws2_32

getaddrinfo freeaddrinfo inet_ntop WSACleanup WSAStartup gethostname

Name

.text

Size

796KB

Virtual Size

795KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_30dcba692dab2244ad2836197608cecd_cobalt-strike_icedid_njrat_satacom_stealc

user32

kernel32

gdi32

gdiplus

advapi32

ole32

ws2_32

generic