2026-07-08_6a49d0f283a7bade0ac3ff31b7566cbe_cobalt-strike_icedid_satacom_stealc

General

Target
2026-07-08_6a49d0f283a7bade0ac3ff31b7566cbe_cobalt-strike_icedid_satacom_stealc
Size 149KB
Sample260708-e6qpcsaz2s
SHA256 1ffdf63137c727206c3b9be5d5c0f22247ebe6d118f6f63fa1a3f30ec67bc7ad
MD5 6a49d0f283a7bade0ac3ff31b7566cbe
SHA1 7f9d146703166be914370eeccd839be269e22afb
SHA512 abec16c5e3235ef1510f23ac3c2cf88a46f301cee59b981cf063ac84c52f89012d85814c262ea5ac3d5fb833bebde1e4a0b70dfbf683c7f038b0e153a5fde324
SSDEEP 3072:WSxQU5k2qjlTwNt4csADgv+e0hqGusmI:NVU9wya20L
TLSH
T13CE34C17A6A970FAE2778938C9520901EB737C768790ABDF03504EB61E236D49E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_6a49d0f283a7bade0ac3ff31b7566cbe_cobalt-strike_icedid_satacom_stealc

File Explorer

2026-07-08_6a49d0f283a7bade0ac3ff31b7566cbe_cobalt-strike_icedid_satacom_stealc

.exe 149KB

2026-07-08_6a49d0f283a7bade0ac3ff31b7566cbe_cobalt-strike_icedid_satacom_stealc

IMPHASH 0d9eacad84297d4645beb642b3ad02dc
SHA256 1ffdf63137c727206c3b9be5d5c0f22247ebe6d118f6f63fa1a3f30ec67bc7ad
MD5 6a49d0f283a7bade0ac3ff31b7566cbe
SHA1 7f9d146703166be914370eeccd839be269e22afb
SHA512 abec16c5e3235ef1510f23ac3c2cf88a46f301cee59b981cf063ac84c52f89012d85814c262ea5ac3d5fb833bebde1e4a0b70dfbf683c7f038b0e153a5fde324
SSDEEP 3072:WSxQU5k2qjlTwNt4csADgv+e0hqGusmI:NVU9wya20L
TLSH
T13CE34C17A6A970FAE2778938C9520901EB737C768790ABDF03504EB61E236D49E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

17344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

connect inet_ntop inet_pton WSAStartup socket shutdown send recv htons getsockname closesocket

kernel32

HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetLastError CreateMutexA Sleep WideCharToMultiByte SetConsoleCtrlHandler GetProcessHeap SetEnvironmentVariableW CreateFileW WriteConsoleW CloseHandle LeaveCriticalSection QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess GetProcAddress GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW

user32

MessageBoxA

advapi32

RegOpenKeyExA RegCloseKey GetUserNameW RegQueryValueExA

Name

.text

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_6a49d0f283a7bade0ac3ff31b7566cbe_cobalt-strike_icedid_satacom_stealc

ws2_32

kernel32

user32

advapi32

generic