2026-07-05_c027f9f4f88f8148b86e6a79f276f8cb_cobalt-strike_icedid_njrat_satacom_stealc

Resubmissions

07/08/2026, 07:13

260807-h2gsfazbrg10

06/08/2026, 15:04

260806-sfkmbatfmg3

05/07/2026, 10:09

260705-l6ytasbx3v8

05/07/2026, 10:06

260705-l5cvfabw8110

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_c027f9f4f88f8148b86e6a79f276f8cb_cobalt-strike_icedid_njrat_satacom_stealc
Size 2.3MB
Sample260705-l6ytasbx3v
SHA256 08e25d850a33314669d27d15e23d1a035c3a692589608e7f8a2fc98a2689fc6a
MD5 c027f9f4f88f8148b86e6a79f276f8cb
SHA1 a6b59bf0da82211def7494052086471f5603d306
SHA512 87144bec4ad1978cd60a45cc54e2917847b57495dd847304b4795c2eefff2ac4b20f380dc98aa4708b96658c1a105d7b2b9000197ec39adf89e4b2f8dd7e7994
SSDEEP 49152:7gNIrBCJyFPoT9AUeWWEcklTk5ULxg4XAnaWr:7FAT9Be5exg4c
TLSH
T196B5D01AA2F802FDD0B7D274C9469903EBB1784A13349AEF13D58D952F23A716E7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_c027f9f4f88f8148b86e6a79f276f8cb_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-05_c027f9f4f88f8148b86e6a79f276f8cb_cobalt-strike_icedid_njrat_satacom_stealc

.exe 2.3MB

2026-07-05_c027f9f4f88f8148b86e6a79f276f8cb_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 9f92cab13c10c41fee664c7978416676
SHA256 08e25d850a33314669d27d15e23d1a035c3a692589608e7f8a2fc98a2689fc6a
MD5 c027f9f4f88f8148b86e6a79f276f8cb
SHA1 a6b59bf0da82211def7494052086471f5603d306
SHA512 87144bec4ad1978cd60a45cc54e2917847b57495dd847304b4795c2eefff2ac4b20f380dc98aa4708b96658c1a105d7b2b9000197ec39adf89e4b2f8dd7e7994
SSDEEP 49152:7gNIrBCJyFPoT9AUeWWEcklTk5ULxg4XAnaWr:7FAT9Be5exg4c
TLSH
T196B5D01AA2F802FDD0B7D274C9469903EBB1784A13349AEF13D58D952F23A716E7E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1066544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_BIND IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ExitProcess MultiByteToWideChar Sleep WideCharToMultiByte DeleteFileA GlobalLock GlobalUnlock ReadFile GetFileSizeEx CreateFileA LoadLibraryA CloseHandle FreeLibrary FindFirstFileA FindNextFileA FindClose GetTempPathA SetFileAttributesA RemoveDirectoryA CreateDirectoryA GetTempFileNameA GetTickCount64 GetCurrentProcessId CreateDirectoryW QueryDosDeviceW GetCurrentProcess WriteFile WaitForSingleObject CreateFileW OpenProcess CreateToolhelp32Snapshot GetLastError Process32NextW TerminateThread DeleteFileW Process32FirstW CreateThread GetModuleHandleW GetSystemInfo ReadProcessMemory VirtualQueryEx GetTickCount K32GetProcessImageFileNameA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle SetConsoleOutputCP CreateRemoteThread ExpandEnvironmentStringsW InitializeProcThreadAttributeList SetFilePointer UpdateProcThreadAttribute DeleteProcThreadAttributeList CreateProcessW CancelIo CreateNamedPipeW PeekNamedPipe GetCurrentThreadId CreateEventW GetOverlappedResult ConnectNamedPipe AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree GetTimeZoneInformation GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile WaitForSingleObjectEx HeapReAlloc RaiseException HeapAlloc HeapCompact HeapDestroy UnlockFile LocalFree LockFileEx GetFileSize DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter FlushFileBuffers WriteConsoleW RtlUnwind SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID GetProcAddress GetModuleHandleA IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetConsoleMode GetConsoleOutputCP EnterCriticalSection GetSystemDirectoryW QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive GetLocaleInfoEx FindFirstFileW FindFirstFileExW FindNextFileW SetFileInformationByHandle CreateFile2 GetFileInformationByHandleEx InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetModuleFileNameW TerminateProcess GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileType SetFilePointerEx

user32

GetDesktopWindow GetCaretBlinkTime GetSysColor OpenClipboard CloseClipboard GetKeyboardType GetClipboardData IsWindowVisible GetSystemMetrics

advapi32

GetUserNameA

shell32

CommandLineToArgvW

ole32

CoTaskMemAlloc CoInitialize CoInitializeEx CoUninitialize

oleaut32

SysAllocString

dwmapi

DwmIsCompositionEnabled

comctl32

ord17

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_c027f9f4f88f8148b86e6a79f276f8cb_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

ole32

oleaut32

dwmapi

comctl32

generic