2026-07-16_c678939a7b96c42579532fb834a19814_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-16_c678939a7b96c42579532fb834a19814_cobalt-strike_icedid_njrat_satacom_stealc
Size 13.3MB
Sample260716-nclmzsbs8n
SHA256 1e7bcb427e54e8598e7e6aa86eee20b7ab9c59020223d78d22618c8f01e30809
MD5 c678939a7b96c42579532fb834a19814
SHA1 0bd6cab19d7018485439fc2179484bd2894b9ad7
SHA512 63cdae6d57d1c4a80176f6d218bbd641c0e5503cb9094eeaf7f26a2e649feadc7b050d6d49ad3572c30d3737fc75124a93e58085a68d527d15a32afc23f72ef4
SSDEEP 393216:aREMxSAz4bouE6cLVwrr351RcPvF6E+gsX24:PM10s6rrRbe4
TLSH
T1EBE612D966E641BDC0219130D586D3F6E1967C080E798C57BFC24E033A359E2E8B7B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-16_c678939a7b96c42579532fb834a19814_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-16_c678939a7b96c42579532fb834a19814_cobalt-strike_icedid_njrat_satacom_stealc

.exe 13.3MB

2026-07-16_c678939a7b96c42579532fb834a19814_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 54d306f76d19ab8842f4bd43def10937
SHA256 1e7bcb427e54e8598e7e6aa86eee20b7ab9c59020223d78d22618c8f01e30809
MD5 c678939a7b96c42579532fb834a19814
SHA1 0bd6cab19d7018485439fc2179484bd2894b9ad7
SHA512 63cdae6d57d1c4a80176f6d218bbd641c0e5503cb9094eeaf7f26a2e649feadc7b050d6d49ad3572c30d3737fc75124a93e58085a68d527d15a32afc23f72ef4
SSDEEP 393216:aREMxSAz4bouE6cLVwrr351RcPvF6E+gsX24:PM10s6rrRbe4
TLSH
T1EBE612D966E641BDC0219130D586D3F6E1967C080E798C57BFC24E033A359E2E8B7B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

538400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\asus\Desktop\UCRobloxExternal_[unknowncheats.me]_ — kopia\UCRobloxExternal_[unknowncheats.me]_ — kopia\UCRobloxExternal\x64\Release\app.pdb

kernel32

Process32NextW QueryFullProcessImageNameA Process32FirstW CloseHandle FreeConsole Module32FirstW ExitProcess ReadProcessMemory GetModuleHandleW GetConsoleWindow Module32NextW CreateProcessA AllocConsole OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleOutputCP FlushFileBuffers GetConsoleMode GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetModuleFileNameW IsProcessorFeaturePresent ReadFile FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW TerminateProcess GetCurrentProcess Sleep CreateToolhelp32Snapshot GetCommandLineA OpenProcess FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW GetProcessId SetConsoleMode GetStdHandle WriteProcessMemory SetConsoleTitleA EnumSystemLocalesW GetModuleFileNameA LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetLastError GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable RtlUnwind

user32

UpdateWindow FindWindowA SetProcessDPIAware PostQuitMessage GetCursorPos SetWindowLongW FindWindowW TranslateMessage SetLayeredWindowAttributes GetForegroundWindow SetWindowDisplayAffinity SetForegroundWindow SendInput GetClientRect GetWindowTextA GetKeyState GetMessageExtraInfo GetCapture TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowLongW GetWindowThreadProcessId DefWindowProcW DestroyWindow SetWindowPos CreateWindowExW ScreenToClient GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW GetCursorInfo ClientToScreen PeekMessageW

shell32

ShellExecuteW ShellExecuteA

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

723KB

Virtual Size

722KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

192KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12.3MB

Virtual Size

12.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-16_c678939a7b96c42579532fb834a19814_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

shell32

d3d11

dwmapi

version

wininet

imm32

d3dcompiler_47

generic