2026-07-07_785a6fe075f5dbee22162d7e0b6e4462_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-07_785a6fe075f5dbee22162d7e0b6e4462_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.7MB
Sample260707-thrdbahs3v
SHA256 7e18a5275bf3f977e835a85c20ea4befda7ff12f9bfb9f3db4692c2fe7aebcb2
MD5 785a6fe075f5dbee22162d7e0b6e4462
SHA1 d489e92a84025332bdf4b080c3b3b79fdcb93d00
SHA512 8ec7382551c1851f65420c8c8e917c17083df6001dfad8caeaccbdbbd7159bf4674b4a23ba5c0b703d7888c350b393e3a74c03d0fd2da70a38a5027880317ad6
SSDEEP 24576:hsi/mDEo7fzE7pcqpfkG4cy/VO40m+EfX+UbjeuR7YwL:sDV7fzapcqpfkGeO40FOtHeuR7Y
TLSH
T1E185180EAAB682E5D0BAD07CC692A52BFC31345A83305BE356999F532F277E4D53D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
sample	disable_win_def

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-07_785a6fe075f5dbee22162d7e0b6e4462_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-07_785a6fe075f5dbee22162d7e0b6e4462_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.7MB

2026-07-07_785a6fe075f5dbee22162d7e0b6e4462_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 150c485a8a17d3d4fbba4a1d1d262871
SHA256 7e18a5275bf3f977e835a85c20ea4befda7ff12f9bfb9f3db4692c2fe7aebcb2
MD5 785a6fe075f5dbee22162d7e0b6e4462
SHA1 d489e92a84025332bdf4b080c3b3b79fdcb93d00
SHA512 8ec7382551c1851f65420c8c8e917c17083df6001dfad8caeaccbdbbd7159bf4674b4a23ba5c0b703d7888c350b393e3a74c03d0fd2da70a38a5027880317ad6
SSDEEP 24576:hsi/mDEo7fzE7pcqpfkG4cy/VO40m+EfX+UbjeuR7YwL:sDV7fzapcqpfkGeO40FOtHeuR7Y
TLSH
T1E185180EAAB682E5D0BAD07CC692A52BFC31345A83305BE356999F532F277E4D53D700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

753344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

SendMessageW SendMessageTimeoutW PostThreadMessageW DefWindowProcW PostQuitMessage CallWindowProcW RegisterClassW CreateWindowExW IsChild DestroyWindow SetWindowPos IsWindowVisible OpenClipboard CloseClipboard SetClipboardData EmptyClipboard TranslateMessage GetKeyState GetAsyncKeyState keybd_event SendInput SetTimer GetSystemMetrics DrawTextW GetForegroundWindow GetDC ReleaseDC GetWindowTextW GetClientRect MessageBoxW MessageBeep ShowCursor SetCursorPos ClipCursor DispatchMessageW SetFocus FillRect SetWindowLongPtrW EnumWindows GetWindowThreadProcessId GetWindow LockWorkStation SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx ChangeDisplaySettingsW EnumDisplaySettingsW EnumDisplayDevicesW SystemParametersInfoW GetMessageW GetMonitorInfoW MonitorFromPoint

gdi32

MoveToEx SetTextColor StretchBlt SetBkMode SelectObject LineTo DeleteObject DeleteDC CreateSolidBrush CreatePen CreateFontW CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap BitBlt

gdiplus

GdipAlloc GdipDisposeImage GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipSaveImageToFile GdiplusStartup GdipCloneImage GdiplusShutdown GdipFree

shell32

ShellExecuteW

urlmon

URLDownloadToFileW

iphlpapi

GetAdaptersAddresses

ws2_32

inet_ntop socket send recv inet_addr htons connect closesocket

winmm

waveInStop waveOutSetVolume waveInStart waveInAddBuffer waveInUnprepareHeader waveInPrepareHeader waveInClose mciSendStringW waveInOpen waveInGetNumDevs

winhttp

WinHttpWebSocketClose WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpWebSocketCompleteUpgrade WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen

advapi32

RegCloseKey RegSetValueExW RegQueryValueExW RegOpenKeyExW RegEnumKeyExW SystemFunction036 LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

kernel32

LoadLibraryExW HeapReAlloc HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA IsProcessorFeaturePresent GetFileType GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx LCMapStringW GetLocaleInfoW GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW OutputDebugStringW IsValidCodePage GetACP RtlLookupFunctionEntry RaiseException RtlPcToFileHeader GetOEMCP GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime LCMapStringEx GetCPInfo CompareStringEx DecodePointer EncodePointer IsValidLocale CompareStringW WakeAllConditionVariable DeleteCriticalSection InitializeCriticalSectionEx GetStringTypeW GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindFirstFileExW GetLocaleInfoEx FormatMessageA LocalFree AcquireSRWLockExclusive ReleaseSRWLockExclusive GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize SetEndOfFile GetCurrentProcessId GetStdHandle GetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesW GetLogicalDrives ReadFile SetFileAttributesW WriteFile Beep CloseHandle SetHandleInformation CreatePipe WaitForSingleObject Sleep GetCurrentProcess RtlUnwind ExitProcess TerminateProcess GetCurrentThread CreateProcessW GetThreadId OpenProcess GlobalMemoryStatusEx GetLocalTime GetTickCount GetTickCount64 GetNativeSystemInfo GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryW GlobalAlloc GlobalUnlock GlobalLock GlobalFree CopyFileW GetComputerNameW GetSystemPowerStatus MultiByteToWideChar WideCharToMultiByte WriteConsoleW CreateToolhelp32Snapshot Process32FirstW Process32NextW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemInfo VirtualProtect QueryPerformanceCounter QueryPerformanceFrequency GetLastError WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread

Name

.text

Size

979KB

Virtual Size

978KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

232KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

440KB

Virtual Size

439KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-07_785a6fe075f5dbee22162d7e0b6e4462_cobalt-strike_icedid_njrat_satacom_stealc

user32

gdi32

gdiplus

shell32

urlmon

iphlpapi

ws2_32

winmm

winhttp

advapi32

kernel32

generic