2026-07-16_06b3eb3f69508217142c0f05231181a5_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-07-16_06b3eb3f69508217142c0f05231181a5_cobalt-strike_icedid_njrat_satacom_stealc
Size 4.1MB
Sample260716-eb7dmacw2p
SHA256 6484a8063df68014e80d8f7ecde67a3e7ac6f14bac14c4e309ff197328c10093
MD5 06b3eb3f69508217142c0f05231181a5
SHA1 2eabf58110d8cb5e22883ff04501e200b5b54c80
SHA512 5e8c4e8601826bfa6edaba28a2e96d96713dfe3f3437fd9eb7eeff7ade9b65b2919d2c172423189ca08a081f00eeedffacb5d425fb3d99b3c644a9760f0b157e
SSDEEP 98304:NTzk6o47yFt6dCnzSyrUdNWl3jjLtxE6jEqdaOFPkb:N0Ii6on7pjjLjXjEqlPw
TLSH
T12416331AB7A611E4C1B3C130C0560A1AFD77B419077497EB4BA08BA69F3B7E46C3D762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-16_06b3eb3f69508217142c0f05231181a5_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-16_06b3eb3f69508217142c0f05231181a5_cobalt-strike_icedid_njrat_satacom_stealc

.exe 4.1MB

2026-07-16_06b3eb3f69508217142c0f05231181a5_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH f81d3d255ada9227eb0e702430a11141
SHA256 6484a8063df68014e80d8f7ecde67a3e7ac6f14bac14c4e309ff197328c10093
MD5 06b3eb3f69508217142c0f05231181a5
SHA1 2eabf58110d8cb5e22883ff04501e200b5b54c80
SHA512 5e8c4e8601826bfa6edaba28a2e96d96713dfe3f3437fd9eb7eeff7ade9b65b2919d2c172423189ca08a081f00eeedffacb5d425fb3d99b3c644a9760f0b157e
SSDEEP 98304:NTzk6o47yFt6dCnzSyrUdNWl3jjLtxE6jEqdaOFPkb:N0Ii6on7pjjLjXjEqlPw
TLSH
T12416331AB7A611E4C1B3C130C0560A1AFD77B419077497EB4BA08BA69F3B7E46C3D762
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

51808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegOpenKeyExW RegSetValueExW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash

shell32

SHGetFolderPathW

kernel32

WriteConsoleW CreateFileW DeleteFileW GetFileSize GetFileSizeEx ReadFile SetFilePointerEx WriteFile GetTempPathW IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle WaitForSingleObject Sleep GetCurrentProcess CreateProcessW GlobalMemoryStatusEx GetSystemInfo GetSystemTime GetSystemDirectoryW GetWindowsDirectoryW VirtualAlloc GetModuleFileNameW GetModuleHandleW GetProcAddress CopyFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetConsoleMode QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP

Name

.text

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-16_06b3eb3f69508217142c0f05231181a5_cobalt-strike_icedid_njrat_satacom_stealc

advapi32

shell32

kernel32

generic