2026-07-18_548e8d85bd8f355dab958ed0cea73e3f_cobalt-strike_icedid_njrat_ryuk_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_548e8d85bd8f355dab958ed0cea73e3f_cobalt-strike_icedid_njrat_ryuk_satacom
Size 2.9MB
Sample260718-neyekacz2v
SHA256 964b1ed1e28788f8c64e065b3c169754d52858ce6654736492fc106ac569b09d
MD5 548e8d85bd8f355dab958ed0cea73e3f
SHA1 2e5047165e476312da4b45eb2010fe8df686c984
SHA512 d53f6902bd878cdbc6e33d6a71ca1dc9dc733e1bd5fc63999300074c5db0146140d40c91d76829ca46f6f51f13ca862fc077b83e40d7f52a67a60e2adfc95be7
SSDEEP 49152:65bfhfbGBUOBOVio0ORBQ9nCMlqGZAlQLYFiD9YeJOCiK:eZCKun+X+7OjK
TLSH
T104D56B07B39901D8F21AC17B8F769122BB607C414B2FAEDF365076451BBAEE45B3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_548e8d85bd8f355dab958ed0cea73e3f_cobalt-strike_icedid_njrat_ryuk_satacom

File Explorer

2026-07-18_548e8d85bd8f355dab958ed0cea73e3f_cobalt-strike_icedid_njrat_ryuk_satacom

.exe 2.9MB

2026-07-18_548e8d85bd8f355dab958ed0cea73e3f_cobalt-strike_icedid_njrat_ryuk_satacom

IMPHASH e44ca5f1b7331e2652301e3bf44db2f8
SHA256 964b1ed1e28788f8c64e065b3c169754d52858ce6654736492fc106ac569b09d
MD5 548e8d85bd8f355dab958ed0cea73e3f
SHA1 2e5047165e476312da4b45eb2010fe8df686c984
SHA512 d53f6902bd878cdbc6e33d6a71ca1dc9dc733e1bd5fc63999300074c5db0146140d40c91d76829ca46f6f51f13ca862fc077b83e40d7f52a67a60e2adfc95be7
SSDEEP 49152:65bfhfbGBUOBOVio0ORBQ9nCMlqGZAlQLYFiD9YeJOCiK:eZCKun+X+7OjK
TLSH
T104D56B07B39901D8F21AC17B8F769122BB607C414B2FAEDF365076451BBAEE45B3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

914976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msedge_proxy.exe.pdb

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetModuleInfo64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

oleaut32

SysAllocString SysAllocStringLen SysFreeString VariantClear

shlwapi

PathMatchSpecW ord487 SHStrDupW

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CompareStringOrdinal CompareStringW CreateDirectoryW CreateEventW CreateFileW CreateIoCompletionPort CreateProcessW CreateThread DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentPackageFullName GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetThreadContext GetThreadId GetThreadPriority GetThreadPriorityBoost GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleInformation LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MultiByteToWideChar OutputDebugStringA PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetHandleInformation SetInformationJobObject SetLastError SetStdHandle SetThreadInformation SetThreadPriority SetThreadPriorityBoost SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SuspendThread SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcmpW lstrcmpiW

ntdll

NtClose NtOpenKeyEx NtQueryValueKey RtlFormatCurrentUserKeyPath RtlFreeUnicodeString RtlInitUnicodeString

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError RoOriginateErrorW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString WindowsCreateStringReference WindowsDeleteString WindowsGetStringRawBuffer WindowsIsStringEmpty WindowsStringHasEmbeddedNull

api-ms-win-core-winrt-l1-1-0

RoActivateInstance RoGetActivationFactory RoInitialize RoRegisterActivationFactories RoRevokeActivationFactories RoUninitialize

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

341KB

Virtual Size

340KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

70KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

673B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

219B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

408KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_548e8d85bd8f355dab958ed0cea73e3f_cobalt-strike_icedid_njrat_ryuk_satacom

dbghelp

oleaut32

shlwapi

kernel32

ntdll

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-2-0

generic