2026-07-07_c3b2ac3dc1d3d99c6fcc6f344a656203_cobalt-strike_icedid_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-07_c3b2ac3dc1d3d99c6fcc6f344a656203_cobalt-strike_icedid_satacom_stealc
Size 415KB
Sample260708-a7pfgagy3x
SHA256 731d56c0731e5a7cb54af5673c9d31ef7f70fe1a215cfccff55c2c63e38232fa
MD5 c3b2ac3dc1d3d99c6fcc6f344a656203
SHA1 10b5da850b3680219e0011ea9aa24f04dfebe0c1
SHA512 3aefaa0c00457b5e001d64d13512efc5c4ccf5fa9d27242a30299cac0668791a7f545780b13aa9b588e8ae8ba0228fe71a46c828edbd1c2777f6400d1562be0b
SSDEEP 6144:5lXbslWtRB90/vjeeU1g2Ze8sU5Ix/96HFm1:5lXbTXcXje42M8sSY96lm
TLSH
T11294F74BFAB510E1D5FAD0388542662AFCB134AA4330ABCB57D55A571B23BF4E93DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-07_c3b2ac3dc1d3d99c6fcc6f344a656203_cobalt-strike_icedid_satacom_stealc

File Explorer

2026-07-07_c3b2ac3dc1d3d99c6fcc6f344a656203_cobalt-strike_icedid_satacom_stealc

.exe 415KB

2026-07-07_c3b2ac3dc1d3d99c6fcc6f344a656203_cobalt-strike_icedid_satacom_stealc

IMPHASH b5b9e3b7d057ec526397fbfe4b621738
SHA256 731d56c0731e5a7cb54af5673c9d31ef7f70fe1a215cfccff55c2c63e38232fa
MD5 c3b2ac3dc1d3d99c6fcc6f344a656203
SHA1 10b5da850b3680219e0011ea9aa24f04dfebe0c1
SHA512 3aefaa0c00457b5e001d64d13512efc5c4ccf5fa9d27242a30299cac0668791a7f545780b13aa9b588e8ae8ba0228fe71a46c828edbd1c2777f6400d1562be0b
SSDEEP 6144:5lXbslWtRB90/vjeeU1g2Ze8sU5Ix/96HFm1:5lXbTXcXje42M8sSY96lm
TLSH
T11294F74BFAB510E1D5FAD0388542662AFCB134AA4330ABCB57D55A571B23BF4E93DB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

193364

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

DeleteObject CreateSolidBrush

user32

UpdateWindow ShowWindow InvalidateRect ShowCursor SetClassLongPtrW SetForegroundWindow GetSystemMetrics CreateWindowExW DestroyWindow

shell32

SHGetFolderPathW

advapi32

RegCloseKey RegSetValueExW RegOpenKeyExW

winhttp

WinHttpReadData WinHttpWebSocketClose WinHttpConnect WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpWebSocketCompleteUpgrade WinHttpWebSocketSend WinHttpWebSocketReceive WinHttpCloseHandle WinHttpOpen

kernel32

SetStdHandle HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA WriteConsoleW SetEndOfFile CreateFileW GetProcessHeap GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType GetLastError CreateMutexA Sleep GetModuleFileNameW GetModuleHandleW MultiByteToWideChar WideCharToMultiByte GetConsoleWindow LocalFree FormatMessageA GetLocaleInfoEx CloseHandle WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetProcAddress GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx GetStringTypeW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead EnumSystemLocalesW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess GetStdHandle WriteFile HeapFree HeapReAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc VirtualProtect LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID RtlUnwind

Name

.text

Size

298KB

Virtual Size

298KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-07_c3b2ac3dc1d3d99c6fcc6f344a656203_cobalt-strike_icedid_satacom_stealc

gdi32

user32

shell32

advapi32

winhttp

kernel32

generic