2026-07-14_d5f3d37434dd58e4a16897ce5abb6f45_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-07-14_d5f3d37434dd58e4a16897ce5abb6f45_cobalt-strike_icedid_njrat_satacom_stealc
Size 5.0MB
Sample260714-dfmdkse19t
SHA256 1c23ae5490e63e73e108ba1851600bff5d594441142cd0215f03b32f04b0681e
MD5 d5f3d37434dd58e4a16897ce5abb6f45
SHA1 031fb1774cace045d3687fcfbca22afbd84ca3e4
SHA512 4cc48fec153ce35f450cb1147e9baee0890cebc65b794be2d30a6c646c46d8bfbac38c07b0794b947f8639f990488df25e726cefdf7bfe9c5b137bd29a4ad35a
SSDEEP 98304:yG3nHZhSHQILor2nzW4o8O4292X+GF5xIJamzoc/YJaFfZcSCCCv:BH6boL4292/BIYm8cwJaxqSCCCv
TLSH
T11836F206F3E7CAB6E94F8A7D8611822265B67E712374D58F13C628DBED0B6E04D34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-14_d5f3d37434dd58e4a16897ce5abb6f45_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-14_d5f3d37434dd58e4a16897ce5abb6f45_cobalt-strike_icedid_njrat_satacom_stealc

.exe 5.0MB

2026-07-14_d5f3d37434dd58e4a16897ce5abb6f45_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 00c4ec36dffb3cf1d0ee1440ee10f5b0
SHA256 1c23ae5490e63e73e108ba1851600bff5d594441142cd0215f03b32f04b0681e
MD5 d5f3d37434dd58e4a16897ce5abb6f45
SHA1 031fb1774cace045d3687fcfbca22afbd84ca3e4
SHA512 4cc48fec153ce35f450cb1147e9baee0890cebc65b794be2d30a6c646c46d8bfbac38c07b0794b947f8639f990488df25e726cefdf7bfe9c5b137bd29a4ad35a
SSDEEP 98304:yG3nHZhSHQILor2nzW4o8O4292X+GF5xIJamzoc/YJaFfZcSCCCv:BH6boL4292/BIYm8cwJaxqSCCCv
TLSH
T11836F206F3E7CAB6E94F8A7D8611822265B67E712374D58F13C628DBED0B6E04D34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

87:3c:bf:f3:ef:93:77:6e:48:28:77:83:e5:cf:68:36:9f:ab:f6:48:1e:29:b5:41:fc:1a:61:fe:f8:ec:24:f3

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 13, 2023

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:81:a4:c7:63:e7:ad:c5:b4:ee:00:00:00:00:03:81

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 10, 2022 - Mar 8, 2023

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:A240-4B82-130E,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:b8:08:d4:c1:b8:79:e0:51:49:00:01:00:00:01:b8

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 20, 2022 - Dec 14, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

6

Entry point

477088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FreeLibrary QueryPerformanceCounter ReadFile GetModuleFileNameA WriteFile OutputDebugStringA SetFilePointer CopyFileA GetFileAttributesA CreateFileA GetSystemDirectoryA DeleteFileA SetFileAttributesA GetFileSize HeapSize CreateFileW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW LoadLibraryExW VirtualProtect GetConsoleMode FlushFileBuffers GetFileType SetFilePointerEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent GetModuleHandleExW RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc ExitProcess GetLastError GetCommandLineA SetLastError RaiseException Sleep TerminateProcess GetCurrentProcess CloseHandle MultiByteToWideChar GetProcAddress RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime WideCharToMultiByte GetConsoleOutputCP WriteConsoleW GetLocaleInfoW GetCurrentProcessId GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter GetFileSizeEx HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA GetCurrentThreadId GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo

user32

MessageBoxA

winspool.drv

AddMonitorA

advapi32

AllocateAndInitializeSid OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW QueryServiceStatus CloseServiceHandle OpenSCManagerA ControlService StartServiceA FreeSid CheckTokenMembership OpenServiceA LookupPrivilegeValueA

Name

.text

Size

598KB

Virtual Size

598KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

533KB

Virtual Size

533KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3.7MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_d5f3d37434dd58e4a16897ce5abb6f45_cobalt-strike_icedid_njrat_satacom_stealc

PE Signature issue

kernel32

user32

winspool.drv

advapi32

generic