2026-07-06_46225dff75df195d63981b8e95d89def_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_46225dff75df195d63981b8e95d89def_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.6MB
Sample260706-ql47ssfx4x
SHA256 35b7a70043bea654a18ef9c8d84828adb85c25377547169bd8dc2c2c77476b23
MD5 46225dff75df195d63981b8e95d89def
SHA1 148ddf950e318e674d85f3d5790b5e931ca11034
SHA512 698c38c1d72cb08b77d3acd0b3963c0679813a316ca9c0bd48282e90e16311a9641e829b0383285f2d11ada32b591a665d457985e4905a659b401bec1dc2643b
SSDEEP 24576:VdUwizp/Gmf0UWdtgzt6/JK4EwGzX+UbjeuR7YwL:VdUp/Gmf0UW06/JK4QtHeuR7Y
TLSH
T14D753A0EEAB582E5D0BAD078C652B52BFC7134AA83305BE356919B572F237E4D93D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_46225dff75df195d63981b8e95d89def_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-06_46225dff75df195d63981b8e95d89def_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.6MB

2026-07-06_46225dff75df195d63981b8e95d89def_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 1bb0234e5f02c878a7120f32d816ae67
SHA256 35b7a70043bea654a18ef9c8d84828adb85c25377547169bd8dc2c2c77476b23
MD5 46225dff75df195d63981b8e95d89def
SHA1 148ddf950e318e674d85f3d5790b5e931ca11034
SHA512 698c38c1d72cb08b77d3acd0b3963c0679813a316ca9c0bd48282e90e16311a9641e829b0383285f2d11ada32b591a665d457985e4905a659b401bec1dc2643b
SSDEEP 24576:VdUwizp/Gmf0UWdtgzt6/JK4EwGzX+UbjeuR7YwL:VdUp/Gmf0UW06/JK4QtHeuR7Y
TLSH
T14D753A0EEAB582E5D0BAD078C652B52BFC7134AA83305BE356919B572F237E4D93D700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

681520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

EnumDisplayDevicesW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW SystemParametersInfoW LockWorkStation GetWindow GetWindowThreadProcessId EnumWindows MessageBoxW ReleaseDC GetDC TranslateMessage GetMessageW DispatchMessageW SendMessageW SendMessageTimeoutW PostThreadMessageW IsWindowVisible OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetKeyState GetAsyncKeyState keybd_event SendInput GetSystemMetrics

gdi32

CreateCompatibleBitmap CreateCompatibleDC SelectObject DeleteObject DeleteDC BitBlt

gdiplus

GdipGetImageEncodersSize GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipSaveImageToFile GdipDisposeImage GdipCloneImage GdiplusShutdown GdipAlloc GdipFree GdiplusStartup

shell32

ShellExecuteW

urlmon

URLDownloadToFileW

iphlpapi

GetAdaptersAddresses

ws2_32

socket inet_ntop closesocket connect htons inet_addr send recv

winmm

waveInStart waveInAddBuffer waveInUnprepareHeader waveInPrepareHeader waveInClose waveInOpen waveInGetNumDevs waveOutSetVolume waveInStop

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpSendRequest WinHttpOpen WinHttpReceiveResponse WinHttpQueryHeaders WinHttpWebSocketCompleteUpgrade WinHttpWebSocketSend WinHttpWebSocketReceive WinHttpWebSocketClose

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey SystemFunction036 RegSetValueExW

kernel32

SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW ReadConsoleW OutputDebugStringW IsValidCodePage GetACP GetOEMCP HeapReAlloc HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext SetEnvironmentVariableW GetCommandLineA TerminateProcess GetCurrentProcess IsProcessorFeaturePresent GetFileType GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader SetStdHandle GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime LCMapStringEx GetCPInfo CompareStringEx DecodePointer EncodePointer WakeAllConditionVariable DeleteCriticalSection InitializeCriticalSectionEx GetStringTypeW GetFileInformationByHandleEx GetProcessHeap HeapSize SetEndOfFile GetCommandLineW MultiByteToWideChar GetStdHandle GetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesW GetLogicalDrives ReadFile SetFileAttributesW WriteFile Beep CloseHandle SetHandleInformation CreatePipe WaitForSingleObject Sleep GetCurrentProcessId ExitProcess CreateProcessW GetThreadId GlobalMemoryStatusEx GetLocalTime GetTickCount64 GetNativeSystemInfo GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryW GlobalAlloc GlobalUnlock GlobalLock GlobalFree CopyFileW GetComputerNameW GetSystemPowerStatus RtlUnwind WideCharToMultiByte WriteConsoleW CreateToolhelp32Snapshot Process32FirstW Process32NextW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemInfo VirtualProtect QueryPerformanceCounter QueryPerformanceFrequency GetLastError WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI

Name

.text

Size

885KB

Virtual Size

885KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

202KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

440KB

Virtual Size

439KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_46225dff75df195d63981b8e95d89def_cobalt-strike_icedid_njrat_satacom_stealc

user32

gdi32

gdiplus

shell32

urlmon

iphlpapi

ws2_32

winmm

winhttp

advapi32

kernel32

generic