2026-07-13_b0b149fbcc003bc83167a79047f66231_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-13_b0b149fbcc003bc83167a79047f66231_cobalt-strike_icedid_njrat_satacom_stealc
Size 12.2MB
Sample260713-heb9faex91
SHA256 4e7cfbd7d306e359e6768a914b82f210ec0c1309e5c2b84e1842cc52371f7f95
MD5 b0b149fbcc003bc83167a79047f66231
SHA1 153578b130e7abda450fa32f2d27708189f30a6d
SHA512 477a3d530afc5976b5edd0a1c5c9389ef1115c4a88c0a46572adf3c7811dc64a88389573b73019a43979d7a2fd26867a5ab02498d957ad4dbefc1612a6582112
SSDEEP 98304:UBLFZFCBtHK4Y3ElSquLLs+Ia86Mi4+Y8NtGZw15tdWSqLI:UBL/KKN0l9FXi4/YkZwldfGI
TLSH
T1D4D66A21215950D9D0E9F074CA17D16BD72A3CC563E0AEE712E07B362F369EE1B3A718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-13_b0b149fbcc003bc83167a79047f66231_cobalt-strike_icedid_njrat_satacom_stealc

.exe 12.2MB

2026-07-13_b0b149fbcc003bc83167a79047f66231_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH ba77374558da3c7aa659c29f633c4b8f
SHA256 4e7cfbd7d306e359e6768a914b82f210ec0c1309e5c2b84e1842cc52371f7f95
MD5 b0b149fbcc003bc83167a79047f66231
SHA1 153578b130e7abda450fa32f2d27708189f30a6d
SHA512 477a3d530afc5976b5edd0a1c5c9389ef1115c4a88c0a46572adf3c7811dc64a88389573b73019a43979d7a2fd26867a5ab02498d957ad4dbefc1612a6582112
SSDEEP 98304:UBLFZFCBtHK4Y3ElSquLLs+Ia86Mi4+Y8NtGZw15tdWSqLI:UBL/KKN0l9FXi4/YkZwldfGI
TLSH
T1D4D66A21215950D9D0E9F074CA17D16BD72A3CC563E0AEE712E07B362F369EE1B3A718
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

0a:1f:0f:8d:88:64:b6:cc:15:77:56:40:aa:b6:38:6c:cd:4b:2d:9e:d7:50:b9:1c:9c:a5:d0:32:7a:c8:6c:cd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=James Chapman,O=James Chapman,L=Ashford,ST=Kent,C=GB

Chains

Jul 9, 2026

CN=James Chapman,O=James Chapman,L=Ashford,ST=Kent,C=GB

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=James Chapman,O=James Chapman,L=Ashford,ST=Kent,C=GB

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=James Chapman,O=James Chapman,L=Ashford,ST=Kent,C=GB

Serial Number

39:32:9e:be:80:da:fa:d0:09:fd:6c:51:9e:67:e1:3f

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 8, 2023 - Dec 7, 2026

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Minor OS version

Major OS version

Entry point

4046816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\James\Documents\Source\VUPlayer\x64\Release\VUPlayer.pdb

comctl32

InitCommonControlsEx ImageList_Add ImageList_Destroy ImageList_Create ImageList_GetImageInfo ImageList_GetImageCount PropertySheetW ord380 CreatePropertySheetPageW

rpcrt4

UuidFromStringA UuidToStringA UuidCreate RpcStringFreeA

d2d1

ord1

d3d11

D3D11CreateDevice

crypt32

CryptUnprotectData CryptStringToBinaryA CryptBinaryToStringA CryptProtectData

gdiplus

GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipFillRectangleI GdiplusShutdown GdiplusStartup GdipMeasureString GdipCreateFontFromLogfontA GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipCloneStringFormat GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipDrawString GdipDeleteFont GdipCreateFontFromLogfontW GdipCreateFontFromDC GdipDrawImage GdipSetTextRenderingHint GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipCreateSolidFill GdipDeleteBrush GdipGetImageWidth GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageRawFormat GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawRectangleI GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromHBITMAP GdipSaveImageToStream GdipDeletePen GdipCreatePen1 GdipDrawImageRectI GdipGraphicsClear GdipSetInterpolationMode GdipDeleteGraphics GdipCreateFromHDC GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetImageHeight

uxtheme

IsAppThemed

mpr

WNetGetUniversalNameW

wininet

InternetQueryDataAvailable HttpQueryInfoA HttpSendRequestA InternetOpenA InternetCloseHandle InternetConnectA InternetReadFile HttpOpenRequestA

bass

BASS_ChannelSetAttribute BASS_ChannelPause BASS_ChannelStop BASS_ChannelPlay BASS_ChannelIsActive BASS_ChannelBytes2Seconds BASS_ChannelGetPosition BASS_Free BASS_Init BASS_GetDeviceInfo BASS_ErrorGetCode BASS_SetConfigPtr BASS_GetConfig BASS_ChannelGetLevelEx BASS_ChannelSlideAttribute BASS_ChannelSetPosition BASS_ChannelSetSync BASS_ChannelSetFX BASS_ChannelRemoveFX BASS_FXSetParameters BASS_FXGetParameters BASS_StreamCreateURL BASS_GetInfo BASS_ChannelSeconds2Bytes BASS_ChannelGetLength BASS_StreamCreate BASS_StreamFree BASS_StreamPutData BASS_ChannelGetData BASS_SetConfig BASS_GetVersion BASS_ChannelGetAttribute BASS_ChannelGetTags BASS_ChannelGetInfo BASS_MusicFree BASS_MusicLoad BASS_StreamCreateFile BASS_PluginFree BASS_PluginLoad

bassmidi

BASS_MIDI_FontInit BASS_MIDI_FontFree BASS_MIDI_StreamSetFonts

basswasapi

BASS_WASAPI_SetNotify BASS_WASAPI_GetDeviceInfo BASS_WASAPI_GetLevelEx BASS_WASAPI_GetData BASS_WASAPI_IsStarted BASS_WASAPI_Stop BASS_WASAPI_Start BASS_WASAPI_GetInfo BASS_WASAPI_Free BASS_WASAPI_Init BASS_WASAPI_CheckFormat BASS_WASAPI_GetDevice

bassmix

BASS_Mixer_StreamCreate BASS_Mixer_StreamAddChannel BASS_Mixer_ChannelGetMixer BASS_Mixer_ChannelGetData BASS_Mixer_ChannelGetLevelEx BASS_Mixer_ChannelGetPosition

bassasio

BASS_ASIO_GetDeviceInfo BASS_ASIO_GetDevice BASS_ASIO_ChannelIsActive BASS_ASIO_ChannelPause BASS_ASIO_ChannelEnableBASS BASS_ASIO_ChannelReset BASS_ASIO_GetLatency BASS_ASIO_IsStarted BASS_ASIO_Stop BASS_ASIO_Start BASS_ASIO_SetRate BASS_ASIO_CheckRate BASS_ASIO_GetInfo BASS_ASIO_SetNotify BASS_ASIO_Free BASS_ASIO_Init

avcodec-62

avcodec_receive_packet avcodec_send_packet av_packet_alloc av_packet_free av_packet_unref avcodec_alloc_context3 avcodec_free_context avcodec_parameters_to_context avcodec_open2 avcodec_send_frame avcodec_receive_frame avcodec_find_encoder avcodec_get_supported_config avcodec_parameters_from_context

avformat-62

av_write_trailer av_guess_format avformat_alloc_context avformat_open_input avformat_find_stream_info av_find_best_stream av_read_frame avformat_seek_file avformat_close_input avio_open avio_closep avformat_free_context avformat_new_stream avformat_write_header av_write_frame

avutil-60

av_strdup av_frame_unref av_frame_free av_frame_alloc av_get_bytes_per_sample av_opt_set av_version_info av_frame_get_buffer

swresample-6

swr_alloc_set_opts2 swr_free swr_convert swr_get_out_samples swr_init

kernel32

CompareStringEx WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetSystemTimePreciseAsFileTime SleepConditionVariableSRW GetFileInformationByHandleEx SetStdHandle CreateFile2 SetFileInformationByHandle SetFileAttributesW GetFileInformationByHandle SetUnhandledExceptionFilter FindFirstFileW GetCurrentDirectoryW GetLocaleInfoEx GetStringTypeW GetLogicalProcessorInformationEx GetExitCodeThread AcquireSRWLockExclusive ReleaseSRWLockExclusive FlsSetValue WriteConsoleW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter FlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCPInfo GetStartupInfoW InitializeSListHead RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc IsValidCodePage GetFileType SleepConditionVariableCS InitializeConditionVariable WakeConditionVariable SetErrorMode GetCommandLineW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadConsoleW GlobalFree GlobalLock GlobalUnlock GlobalAlloc GetModuleFileNameW FindResourceW SizeofResource GetTimeZoneInformation FlsGetValue ExitProcess TerminateProcess PeekNamedPipe GetStdHandle GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW RtlUnwind IsProcessorFeaturePresent LockResource LoadResource GetTimeFormatW GetDateFormatW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime VerifyVersionInfoW SetFileTime VerSetConditionMask CreateDirectoryW GetVolumePathNameW CreateProcessW GetExitCodeProcess CreateSemaphoreW ReleaseSemaphore SetThreadPriority FindNextFileW FindFirstFileExW FindClose GetFileSizeEx MoveFileExW ReadDirectoryChangesW CancelIoEx GetOverlappedResult GetFileTime GetCurrentThreadId DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException AreFileApisANSI ReadFile HeapCreate HeapFree GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW GetCurrentProcess GlobalMemoryStatusEx K32GetProcessMemoryInfo CloseHandle SetEvent ResetEvent WaitForSingleObject CreateEventW WaitForMultipleObjects CreateThread GetDriveTypeW GetFileAttributesW GetLogicalDriveStringsW GetVolumeInformationW CreateFileW DeviceIoControl GetModuleHandleW QueryPerformanceCounter QueryPerformanceFrequency FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary SystemTimeToFileTime GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx LocalFree GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo GetNativeSystemInfo HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetLastError GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile CreateMutexW TzSpecificLocalTimeToSystemTime

user32

DestroyIcon GetDoubleClickTime GetDlgCtrlID TrackMouseEvent IsDialogMessageW LoadIconW FindWindowW SetForegroundWindow TranslateAcceleratorW DestroyWindow IntersectRect DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW ScreenToClient MessageBoxW GetWindowTextLengthW ReleaseCapture SetCapture GetCapture EndPaint BeginPaint RegisterClassExW DefWindowProcW MonitorFromPoint FillRect GetCursorPos RedrawWindow UpdateWindow DeleteMenu ModifyMenuW AppendMenuW InsertMenuW GetMenuItemCount GetMenuItemID CheckMenuItem CreatePopupMenu GetMenuStringW GetSystemMetrics PostQuitMessage LoadStringW SendMessageW PostMessageW DialogBoxParamW EndDialog GetDlgItem SetDlgItemTextW SetTimer KillTimer GetClientRect GetWindowLongPtrW SetWindowLongPtrW CreateWindowExW ShowWindow SetWindowPos SetWindowTextW GetWindowRect MapWindowPoints GetDlgItemTextW SetDlgItemInt GetDlgItemInt CheckRadioButton IsDlgButtonChecked CheckDlgButton EnableWindow IsWindowEnabled GetWindowTextW GetWindowPlacement SetWindowPlacement CreateDialogParamW SetFocus CallWindowProcW GetAsyncKeyState GetKeyNameTextW GetParent InvalidateRect MoveWindow IsWindowVisible OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard IsClipboardFormatAvailable LoadMenuW DestroyMenu EnableMenuItem GetSubMenu TrackPopupMenu GetDC ReleaseDC SetCursor ClientToScreen PtInRect LoadCursorW RegisterDeviceNotificationW UnregisterDeviceNotification LoadStringA RegisterHotKey UnregisterHotKey MapVirtualKeyW GetDesktopWindow LoadImageW GetIconInfo SystemParametersInfoW GetSysColor IsIconic IsZoomed GetFocus LoadAcceleratorsW CreateAcceleratorTableW CopyAcceleratorTableW

gdi32

DeleteObject GetObjectW GetBkColor GetDeviceCaps GetDIBits SetDIBits ExcludeClipRect CreateFontIndirectW GetObjectA CreateDIBitmap

comdlg32

ChooseFontW ChooseColorW GetOpenFileNameW GetSaveFileNameW

advapi32

CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW

shell32

SHCreateItemFromParsingName Shell_NotifyIconGetRect Shell_NotifyIconW CommandLineToArgvW DragQueryFileW ShellExecuteW SHGetKnownFolderPath SHBrowseForFolderW SHGetPathFromIDListEx

ole32

CreateStreamOnHGlobal CoUninitialize CoInitializeEx CoTaskMemFree CoCreateInstance CLSIDFromString

Name

.text

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

asmcode

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

935KB

Virtual Size

935KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

44KB

Virtual Size

501KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

169KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=200, id=261, version=33145,

count=35, id=259, version=33145,

count=3, id=253, version=35721,

count=21, id=259, version=35721,

count=17, id=260, version=35721,

count=107, id=261, version=35721,

count=47, id=260, version=33145,

count=1, id=262, version=33145,

count=3, id=261, version=35729,

count=8, id=257, version=36248,

count=2, id=257, version=35226,

count=1, id=259, version=35729,

count=239, id=260, version=35729,

count=8, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=263, version=33145,

count=33, id=257, version=33145,

count=556, id=1, productName=Unmarked objects,

count=3, id=260, version=36248,

count=239, id=261, version=36248,

count=1, id=255, version=36248,

count=1, id=151,

count=1, id=258, version=36248,