2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.9MB
Sample260711-ca533aav2n
SHA256 6ea210c873ee0536f8acebeff2d15638962810e7146785b0eaf54388cecf29f6
MD5 03eabada40ca282b2ee449afadc0fd11
SHA1 fc92d33b35428c7d230056b332674bf773f90827
SHA512 c497831096d57d550b7a13ac3c2886f28136a7a9688d76d1e5ca1f9342823ac4603625f9d8790e62acf28698586e66157f14956e25b5acf8a424ea1fee7ba99c
SSDEEP 24576:PrtbTaCDTSvF2HhUsizFU/nQdjXthtI1tq43pSjgo5yMDJY:PZqCDOcHmsizS/Qxy1Wj
TLSH
T1E5958D17A37900EDD177C1B88A165607EBB1744A0334AADF13D0D9A62F23EE16B7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.9MB

2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH a85ffe0017ad0cf602b18762ba1f4829
SHA256 6ea210c873ee0536f8acebeff2d15638962810e7146785b0eaf54388cecf29f6
MD5 03eabada40ca282b2ee449afadc0fd11
SHA1 fc92d33b35428c7d230056b332674bf773f90827
SHA512 c497831096d57d550b7a13ac3c2886f28136a7a9688d76d1e5ca1f9342823ac4603625f9d8790e62acf28698586e66157f14956e25b5acf8a424ea1fee7ba99c
SSDEEP 24576:PrtbTaCDTSvF2HhUsizFU/nQdjXthtI1tq43pSjgo5yMDJY:PZqCDOcHmsizS/Qxy1Wj
TLSH
T1E5958D17A37900EDD177C1B88A165607EBB1744A0334AADF13D0D9A62F23EE16B7E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1243520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTickCount64 CopyFileA GetFileAttributesA QueryFullProcessImageNameA CreateFileA DeleteFileA GetSystemInfo CreateThread SetFileAttributesA GetCurrentProcessId GetDiskFreeSpaceExA CreateDirectoryA InitializeProcThreadAttributeList GetTempPathA UpdateProcThreadAttribute DeleteProcThreadAttributeList LocalFree GetTempFileNameA GetUserDefaultLangID MultiByteToWideChar GlobalSize Beep GlobalLock GetFileSize GetTickCount GlobalUnlock FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary SystemTimeToFileTime GetProcessHeap LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW WaitForSingleObjectEx LoadLibraryA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetDiskFreeSpaceA FormatMessageW HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateMutexA CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException TryEnterCriticalSection DeleteCriticalSection GetModuleHandleA LoadLibraryExA VirtualQuery WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW FindFirstFileExW GetOEMCP GetACP IsValidCodePage ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation SetFilePointerEx GetFileSizeEx GetFileType UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA GetModuleFileNameW GetStdHandle IsProcessorFeaturePresent GetFullPathNameA WriteFile GetCurrentProcess GetFileAttributesExA GetModuleFileNameA GetComputerNameExA CreateProcessA GlobalMemoryStatusEx GetProcAddress Process32Next GetLastError CreateToolhelp32Snapshot CreateFileW OpenProcess WaitForSingleObject FindClose GetEnvironmentVariableA ReleaseMutex ExpandEnvironmentStringsA InitializeCriticalSection CreatePipe LeaveCriticalSection FindNextFileA TerminateProcess EnterCriticalSection FindFirstFileA SetHandleInformation Process32First ReadFile ExitProcess FreeConsole GetModuleHandleExW FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetSystemTimePreciseAsFileTime CloseHandle Sleep GetCurrentThreadId RtlUnwind

user32

ReleaseDC SetCursorPos GetWindowRect DispatchMessageA GetDC IsWindowVisible PostMessageA FillRect CallNextHookEx MessageBeep GetClassNameA BeginPaint EndPaint SendInput InvalidateRect GetSystemMetrics SetForegroundWindow UpdateWindow RegisterClassExA PostQuitMessage PeekMessageA GetClientRect SetCursor ClipCursor TranslateMessage BringWindowToTop CreateWindowExA DefWindowProcA EnumWindows UnhookWindowsHookEx MoveWindow EnumDisplaySettingsA MessageBoxA ChangeDisplaySettingsA SetWindowsHookExA ShowCursor ShowWindow DrawTextA DestroyWindow

gdi32

BitBlt CreateCompatibleBitmap CreateFontA SelectObject SetDeviceGammaRamp CreateCompatibleDC GetStockObject GetDeviceCaps DeleteDC SetTextColor SetBkColor DeleteObject CreateSolidBrush

advapi32

RegCloseKey GetUserNameA RegQueryValueExA RegDeleteValueA RevertToSelf RegGetValueA ImpersonateLoggedOnUser DuplicateTokenEx AdjustTokenPrivileges AllocateAndInitializeSid LookupPrivilegeValueA RegSetValueExA OpenProcessToken FreeSid CheckTokenMembership RegOpenKeyExA

ole32

CoCreateInstance CreateStreamOnHGlobal CoUninitialize GetHGlobalFromStream CoInitialize CoSetProxyBlanket

oleaut32

SysFreeString SysStringByteLen SysAllocStringByteLen

ws2_32

setsockopt htons inet_ntoa gethostname recv connect socket send WSAStartup inet_pton closesocket htonl WSAGetLastError ioctlsocket select WSAIoctl __WSAFDIsSet WSACleanup gethostbyname

crypt32

CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt BCryptGetProperty BCryptDestroyKey

winhttp

WinHttpConnect WinHttpQueryDataAvailable WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse

gdiplus

GdiplusShutdown GdiplusStartup GdipCreateBitmapFromScan0 GdipSaveImageToStream GdipDeleteGraphics GdipGetImageEncoders GdipCloneImage GdipAlloc GdipDrawImageRectI GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipSetInterpolationMode GdipFree GdipGetImageGraphicsContext GdipGetImageEncodersSize

ncrypt

NCryptOpenKey NCryptFreeObject NCryptDecrypt NCryptOpenStorageProvider

winmm

mciSendStringA

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

238KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.data2

Size

256KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_03eabada40ca282b2ee449afadc0fd11_avaddon_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

gdi32

advapi32

ole32

oleaut32

ws2_32

crypt32

bcrypt

winhttp

gdiplus

ncrypt

winmm

generic