2026-07-11_bc6a6a12d582b6c198eceffa9d372eb6_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_bc6a6a12d582b6c198eceffa9d372eb6_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.6MB
Sample260711-st8lasfv2t
SHA256 728e6054ede3f5c3124088e709f76745e352815e7a3fea8e730b8a74eb60eb41
MD5 bc6a6a12d582b6c198eceffa9d372eb6
SHA1 9f53af248bfbbb8a331f233b9795453ad8c8d7cf
SHA512 873cec5be949da488ce643e7d7fc36b0184e31c21a44307d5dfa56b44a833c80702604404882d7c00ca696c81bd67f346c62a2b9f641f249dec379c5721bd6b0
SSDEEP 49152:ZmCJRqhh5boojJfPfPIUEB8nYunAm/h0Iyw:kCQjl2aYsAm/h
TLSH
T1B1757D47E65754D8D06BD5B8836B6502EE11384E8739F8EF17C696672F3B3E09A38302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_bc6a6a12d582b6c198eceffa9d372eb6_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-11_bc6a6a12d582b6c198eceffa9d372eb6_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.6MB

2026-07-11_bc6a6a12d582b6c198eceffa9d372eb6_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 2dace1ec0e26247009ac364ef18708dd
SHA256 728e6054ede3f5c3124088e709f76745e352815e7a3fea8e730b8a74eb60eb41
MD5 bc6a6a12d582b6c198eceffa9d372eb6
SHA1 9f53af248bfbbb8a331f233b9795453ad8c8d7cf
SHA512 873cec5be949da488ce643e7d7fc36b0184e31c21a44307d5dfa56b44a833c80702604404882d7c00ca696c81bd67f346c62a2b9f641f249dec379c5721bd6b0
SSDEEP 49152:ZmCJRqhh5boojJfPfPIUEB8nYunAm/h0Iyw:kCQjl2aYsAm/h
TLSH
T1B1757D47E65754D8D06BD5B8836B6502EE11384E8739F8EF17C696672F3B3E09A38302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing combination of virtualization drivers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1515520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable

kernel32

GetConsoleMode Process32NextW Process32FirstW CloseHandle Module32FirstW GetProcAddress VirtualAllocEx CreateRemoteThread Module32NextW VirtualFreeEx GetTickCount GetModuleFileNameA CreateFileA GetFileSizeEx ReadFile GetModuleHandleW GlobalMemoryStatusEx GetDiskFreeSpaceExA TerminateProcess GetCurrentProcess GetTickCount64 GetCurrentThread GetThreadContext VirtualQuery GlobalFree GetComputerNameA LoadLibraryA GetFileAttributesA GetCurrentProcessId CreateProcessW Process32First Process32Next GetVolumeInformationA VirtualProtect QueryPerformanceFrequency Sleep RaiseException SetLastError OutputDebugStringA GetLastError GetCurrentThreadId InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemInfo VirtualLock VirtualUnlock LoadLibraryExW GetFileType HeapFree HeapAlloc GetCommandLineW GetCommandLineA GetModuleFileNameW WriteFile FreeLibraryAndExitThread GetExitCodeThread MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess GetModuleHandleA WaitForSingleObject SetConsoleMode GetStdHandle SetConsoleTitleA SetConsoleTextAttribute WriteProcessMemory SetEndOfFile CompareStringW RtlUnwind LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetExitCodeProcess ExitThread CreateThread WriteConsoleW HeapSize IsProcessorFeaturePresent CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW GetFileAttributesExW GetConsoleOutputCP QueryPerformanceCounter FindFirstFileExW FindClose HeapReAlloc GetOEMCP GetACP IsValidCodePage FlushFileBuffers ReadConsoleW GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive WideCharToMultiByte SleepConditionVariableSRW WaitForSingleObjectEx InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess FreeLibrary GetModuleHandleExW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetFilePointerEx

user32

ReleaseDC GetDC GetSystemMetrics MessageBoxA GetWindowThreadProcessId GetWindow IsWindowVisible GetWindowTextA GetTopWindow EnumDisplayDevicesA

gdi32

CreateCompatibleBitmap SelectObject BitBlt DeleteDC DeleteObject CreateCompatibleDC

advapi32

CryptCreateHash RegOpenKeyExA RegQueryValueExA RegCloseKey SystemFunction036 CryptReleaseContext CryptDestroyHash CryptGetHashParam CryptHashData CryptAcquireContextA GetUserNameA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

ole32

CreateStreamOnHGlobal

ws2_32

closesocket WSAStartup setsockopt ntohs

iphlpapi

GetTcpTable2 GetAdaptersInfo

gdiplus

GdipCreateBitmapFromHBITMAP GdiplusStartup GdipGetImageEncodersSize GdipGetImageEncoders GdipSaveImageToStream GdipDisposeImage GdiplusShutdown

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

192KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

105KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd7cb

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_bc6a6a12d582b6c198eceffa9d372eb6_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

kernel32

user32

gdi32

advapi32

ole32

ws2_32

iphlpapi

gdiplus

generic