2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.7MB
Sample260713-l4chaafs8j
SHA256 d31695222f7a46f728516b0f3a550ebddc5dc167a00476a54e0dfbf243b91bc1
MD5 e253435ad2b6c1b4ca6bd2f43283bd04
SHA1 bdc8148cce2e4140ca90cd19e0ebc2679b9e589d
SHA512 6c1d5ae611d05bf25fbda72ca09175e81d42da8c87d0746865a585b9d98570d3b8f7d78b752aa699ec56e82af2d364b20a3da7d81b7c888812497b24c33f3651
SSDEEP 24576:/rnIMZ5ocvYcu/B49UMz2dfthwaCu1iSrkfs/RRG0wHTi4J:7Ikocwxqu62dVhBJ5kIG06J
TLSH
T164857D17A37800EDD167C1B8CA165607EB71744A1334AADF13D09AA62F23AE55F7F720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.7MB

2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH a0da2b81fbbf05cf68279947b51a8e96
SHA256 d31695222f7a46f728516b0f3a550ebddc5dc167a00476a54e0dfbf243b91bc1
MD5 e253435ad2b6c1b4ca6bd2f43283bd04
SHA1 bdc8148cce2e4140ca90cd19e0ebc2679b9e589d
SHA512 6c1d5ae611d05bf25fbda72ca09175e81d42da8c87d0746865a585b9d98570d3b8f7d78b752aa699ec56e82af2d364b20a3da7d81b7c888812497b24c33f3651
SSDEEP 24576:/rnIMZ5ocvYcu/B49UMz2dfthwaCu1iSrkfs/RRG0wHTi4J:7Ikocwxqu62dVhBJ5kIG06J
TLSH
T164857D17A37800EDD167C1B8CA165607EB71744A1334AADF13D09AA62F23AE55F7F720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1255424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CopyFileA GetFileAttributesA QueryFullProcessImageNameA CreateFileA DeleteFileA CreateThread SetFileAttributesA GetCurrentProcessId GetDiskFreeSpaceExA CreateDirectoryA GetTickCount InitializeProcThreadAttributeList GetTempPathA UpdateProcThreadAttribute DeleteProcThreadAttributeList LocalFree GetTempFileNameA GetUserDefaultLangID MultiByteToWideChar GlobalSize Beep GlobalLock GetFileSize GlobalUnlock FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary SystemTimeToFileTime GetProcessHeap LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo HeapReAlloc DeleteFileW WaitForSingleObjectEx LoadLibraryA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetDiskFreeSpaceA FormatMessageW HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW CreateMutexW GetTempPathW CreateMutexA SetEndOfFile SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId WaitForSingleObject VirtualQuery WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW FindFirstFileExW GetOEMCP GetACP IsValidCodePage ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation SetFilePointerEx GetFileSizeEx GetFileType UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA GetModuleFileNameW GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread GetFullPathNameA WriteFile GetCurrentProcess GetFileAttributesExA GetModuleFileNameA GetComputerNameExA CreateProcessA GlobalMemoryStatusEx GetProcAddress Process32Next GetLastError CreateToolhelp32Snapshot OpenProcess UnlockFileEx FindClose GetEnvironmentVariableA ExpandEnvironmentStringsA InitializeCriticalSection ReleaseMutex CreatePipe LeaveCriticalSection FindNextFileA TerminateProcess EnterCriticalSection FindFirstFileA SetHandleInformation Process32First ReadFile ExitProcess FreeConsole CloseHandle FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetSystemTimePreciseAsFileTime GetModuleHandleA Sleep LoadLibraryExA RtlUnwind

user32

ShowCursor SetWindowPos IsWindowVisible GetDC DestroyWindow GetWindowRect DispatchMessageA FillRect CallNextHookEx MessageBeep GetClassNameA wsprintfA ShowWindow SetForegroundWindow UpdateWindow RegisterClassExA PostQuitMessage PeekMessageA GetClientRect SetCursor ClipCursor TranslateMessage BringWindowToTop SetLayeredWindowAttributes CreateWindowExA DefWindowProcA EnumWindows UnhookWindowsHookEx MoveWindow InvalidateRect SetCursorPos ReleaseDC BeginPaint EndPaint EnumDisplaySettingsA BlockInput MessageBoxA ChangeDisplaySettingsA SetWindowsHookExA DrawTextA GetSystemMetrics SendInput PostMessageA

gdi32

BitBlt CreateCompatibleBitmap CreateFontA SelectObject SetDeviceGammaRamp CreateCompatibleDC GetStockObject GetDeviceCaps DeleteDC SetTextColor SetBkColor DeleteObject CreateSolidBrush

advapi32

RegDeleteValueA GetUserNameA RegQueryValueExA RevertToSelf RegGetValueA ImpersonateLoggedOnUser DuplicateTokenEx AdjustTokenPrivileges AllocateAndInitializeSid LookupPrivilegeValueA RegSetValueExA OpenProcessToken FreeSid CheckTokenMembership RegCloseKey RegOpenKeyExA

ole32

CoCreateInstance CreateStreamOnHGlobal CoUninitialize GetHGlobalFromStream CoInitialize CoSetProxyBlanket

oleaut32

SysStringByteLen SysFreeString SysAllocStringByteLen

ws2_32

WSAIoctl gethostname __WSAFDIsSet WSACleanup inet_ntoa gethostbyname setsockopt htons recv connect socket send WSAStartup inet_pton closesocket htonl WSAGetLastError ioctlsocket select

crypt32

CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptDestroyKey BCryptGetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey

winhttp

WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse

gdiplus

GdiplusShutdown GdiplusStartup GdipCreateBitmapFromScan0 GdipGetImageEncoders GdipCloneImage GdipAlloc GdipDrawImageRectI GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipSetInterpolationMode GdipFree GdipGetImageGraphicsContext GdipGetImageEncodersSize GdipDeleteGraphics GdipSaveImageToStream

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList

ncrypt

NCryptOpenKey NCryptFreeObject NCryptDecrypt NCryptOpenStorageProvider

winmm

mciSendStringA

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

240KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-13_e253435ad2b6c1b4ca6bd2f43283bd04_avaddon_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

gdi32

advapi32

ole32

oleaut32

ws2_32

crypt32

bcrypt

winhttp

gdiplus

setupapi

ncrypt

winmm

generic