2026-07-14_1a2fcb527ee7e401190d5e3576f3cfda_cobalt-strike_icedid_satacom_stealc

General

Target
2026-07-14_1a2fcb527ee7e401190d5e3576f3cfda_cobalt-strike_icedid_satacom_stealc
Size 245KB
Sample260714-e189hsgv2y
SHA256 2d7fb90821b56c4a9635748eb773ee7f309c50bcd7862fc7f65bccc47a56e4a6
MD5 1a2fcb527ee7e401190d5e3576f3cfda
SHA1 3c4bfb3e940b49f3a9a2862942a0426f90400fda
SHA512 feca099101319a27afeecd7a803594c3268362b432f813e24159df1eb2a98c2b4c5b1e757b4ed50eaca4ff21ba9e8834ac5054eee2640d16b9fbce16ff4018d8
SSDEEP 3072:U2lbTYXSW9jmyT5Dsgd6KsyDt4rjycEgaElayVo5AIcP2bvkKsP9gTJs6wnEk:NV0rFDFd6KsM6+wIgX6wnEk
TLSH
T13B347C4A77A50CF9F9B7C67DCC520506DBB1BC5247A0EA8F13A00AA74F276A09E3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_1a2fcb527ee7e401190d5e3576f3cfda_cobalt-strike_icedid_satacom_stealc

File Explorer

2026-07-14_1a2fcb527ee7e401190d5e3576f3cfda_cobalt-strike_icedid_satacom_stealc

.exe 245KB

2026-07-14_1a2fcb527ee7e401190d5e3576f3cfda_cobalt-strike_icedid_satacom_stealc

IMPHASH 9010fd8f1be6d9bebbee7f80af5f63c7
SHA256 2d7fb90821b56c4a9635748eb773ee7f309c50bcd7862fc7f65bccc47a56e4a6
MD5 1a2fcb527ee7e401190d5e3576f3cfda
SHA1 3c4bfb3e940b49f3a9a2862942a0426f90400fda
SHA512 feca099101319a27afeecd7a803594c3268362b432f813e24159df1eb2a98c2b4c5b1e757b4ed50eaca4ff21ba9e8834ac5054eee2640d16b9fbce16ff4018d8
SSDEEP 3072:U2lbTYXSW9jmyT5Dsgd6KsyDt4rjycEgaElayVo5AIcP2bvkKsP9gTJs6wnEk:NV0rFDFd6KsM6+wIgX6wnEk
TLSH
T13B347C4A77A50CF9F9B7C67DCC520506DBB1BC5247A0EA8F13A00AA74F276A09E3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

52480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

ReleaseDC GetDC GetSystemMetrics GetAsyncKeyState GetKeyState wsprintfA

gdi32

SelectObject GetDIBits DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt

kernel32

GetProcessHeap CreateFileW HeapSize WriteConsoleW SetEndOfFile GetLastError SetStdHandle GetEnvironmentVariableA DeleteFileA FindClose FindFirstFileA FindNextFileA ReadFile CloseHandle SetHandleInformation CreatePipe WaitForSingleObject Sleep CreateProcessA GetTickCount GetModuleFileNameA GetProcAddress LoadLibraryA GetComputerNameA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx RtlUnwind SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW HeapFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc VirtualProtect LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW

Name

.text

Size

155KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_1a2fcb527ee7e401190d5e3576f3cfda_cobalt-strike_icedid_satacom_stealc

user32

gdi32

kernel32

generic