2026-07-08_9bd94a964310045de259fec1272ed815_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-07-08_9bd94a964310045de259fec1272ed815_cobalt-strike_icedid_njrat_satacom_stealc
Size 188KB
Sample260708-eyp3vsbv4m
SHA256 b5324ff745cd333180145f9beb87c6ea11ff8a1460947cc99b8e47c5dca41786
MD5 9bd94a964310045de259fec1272ed815
SHA1 b869e7e87aa02af076c998683fc3ae1c4279be14
SHA512 6c85b804aaa32a1842726c4fb4325fe352a084433d150046a0c7526c7fce416a042404274acc209168b68399ca118ecd6be5c22eddfb7f57a047fb49652989d5
SSDEEP 3072:oBnaQuGRDbilViVWX/1a1krtbR3SOwgfp0IBnStvlPtBae:uJ3yViIXgei6LnStvttBae
TLSH
T1EC146D15B79940FEE2778578C9524902FB72BC464760AEDF43900AF29E236D49F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_9bd94a964310045de259fec1272ed815_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-08_9bd94a964310045de259fec1272ed815_cobalt-strike_icedid_njrat_satacom_stealc

.exe 188KB

2026-07-08_9bd94a964310045de259fec1272ed815_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH e594b63425573bf3fda6fa3d8a67ec9d
SHA256 b5324ff745cd333180145f9beb87c6ea11ff8a1460947cc99b8e47c5dca41786
MD5 9bd94a964310045de259fec1272ed815
SHA1 b869e7e87aa02af076c998683fc3ae1c4279be14
SHA512 6c85b804aaa32a1842726c4fb4325fe352a084433d150046a0c7526c7fce416a042404274acc209168b68399ca118ecd6be5c22eddfb7f57a047fb49652989d5
SSDEEP 3072:oBnaQuGRDbilViVWX/1a1krtbR3SOwgfp0IBnStvlPtBae:uJ3yViIXgei6LnStvttBae
TLSH
T1EC146D15B79940FEE2778578C9524902FB72BC464760AEDF43900AF29E236D49F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

24720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

connect inet_ntop inet_pton WSAStartup socket shutdown send recv htons getsockname closesocket

kernel32

HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle Sleep HeapReAlloc GetModuleFileNameA GetComputerNameA WideCharToMultiByte SetConsoleCtrlHandler GetProcessHeap SetEnvironmentVariableW CreateFileW WriteConsoleW GetLocalTime EncodePointer QueryPerformanceCounter QueryPerformanceFrequency CloseHandle GetLastError WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess GetProcAddress GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType VirtualProtect LoadLibraryExW CompareStringW LCMapStringW SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW

user32

MessageBoxA

advapi32

RegOpenKeyExA RegCloseKey GetUserNameW GetUserNameA RegQueryValueExA

Name

.text

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_9bd94a964310045de259fec1272ed815_cobalt-strike_icedid_njrat_satacom_stealc

ws2_32

kernel32

user32

advapi32

generic