2026-07-20_d46f99ca38bf9b2b08d41b6fdd30855d_cobalt-strike_coinminer_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_d46f99ca38bf9b2b08d41b6fdd30855d_cobalt-strike_coinminer_icedid_njrat_satacom_stealc
Size 9.4MB
Sample260720-elgwqaev5p
SHA256 c738e407ba9456e8503b347eecbae267b4984f09faff451c00327c5eaf296be8
MD5 d46f99ca38bf9b2b08d41b6fdd30855d
SHA1 657a4f326d742295265d9b1fbe00526df0f5a55d
SHA512 a5869552b1083e6947b0c2e9ecd484f206e8861d2d8fc706b2369c3c08083985ce64844bd2be7f5a7a8e2f611ee2801570e126679a1148ce9c74dfd5b3d45648
SSDEEP 49152:bh6BAeRNfAc2eoF4lbmENAsEsLeZrWnJCpwW952qyCO1IkeSAUPOy9x4X44nlKyG:m4PD25mENAsEY9Qb2FCqgHzb
TLSH
T19BA6BEB5A24C4E6BE466B078C1A34653DBF0BF0A2760CFD676CC7C470BAF0D4692495A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_d46f99ca38bf9b2b08d41b6fdd30855d_cobalt-strike_coinminer_icedid_njrat_satacom_stealc

File Explorer

2026-07-20_d46f99ca38bf9b2b08d41b6fdd30855d_cobalt-strike_coinminer_icedid_njrat_satacom_stealc

.exe 9.4MB

2026-07-20_d46f99ca38bf9b2b08d41b6fdd30855d_cobalt-strike_coinminer_icedid_njrat_satacom_stealc

IMPHASH 4b8fdbbea2aff4b0d42268ab23df059c
SHA256 c738e407ba9456e8503b347eecbae267b4984f09faff451c00327c5eaf296be8
MD5 d46f99ca38bf9b2b08d41b6fdd30855d
SHA1 657a4f326d742295265d9b1fbe00526df0f5a55d
SHA512 a5869552b1083e6947b0c2e9ecd484f206e8861d2d8fc706b2369c3c08083985ce64844bd2be7f5a7a8e2f611ee2801570e126679a1148ce9c74dfd5b3d45648
SSDEEP 49152:bh6BAeRNfAc2eoF4lbmENAsEsLeZrWnJCpwW952qyCO1IkeSAUPOy9x4X44nlKyG:m4PD25mENAsEY9Qb2FCqgHzb
TLSH
T19BA6BEB5A24C4E6BE466B078C1A34653DBF0BF0A2760CFD676CC7C470BAF0D4692495A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

299680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

recv connect socket WSACleanup closesocket getaddrinfo WSAStartup send freeaddrinfo

winhttp

WinHttpSendRequest WinHttpConnect WinHttpCloseHandle WinHttpReceiveResponse WinHttpOpen WinHttpOpenRequest WinHttpSetOption

kernel32

GetCommandLineW FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage GetModuleFileNameA Process32First SetPriorityClass GetCurrentProcess WriteFile TerminateProcess CreateMutexA WaitForSingleObject UnmapViewOfFile OpenProcess GetCommandLineA CreateToolhelp32Snapshot Sleep GetTempPathA CopyFileA GetLastError OpenMutexA MoveFileExA QueryFullProcessImageNameA GetEnvironmentStringsW DeleteFileA Process32Next CloseHandle SetFileAttributesA CreateFileMappingA WTSGetActiveConsoleSessionId ExitProcess GetCurrentProcessId CreateProcessA CreateDirectoryA MapViewOfFile GetLogicalProcessorInformation OpenFileMappingA VirtualAlloc VirtualProtect VirtualFree GetLargePageMinimum HeapQueryInformation HeapSize HeapReAlloc GetTimeZoneInformation ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW SetEndOfFile WriteConsoleW CreateFileA IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW HeapFree HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread GetLogicalProcessorInformationEx QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime RtlUnwind ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WideCharToMultiByte WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetProcAddress GetModuleFileNameW GetStdHandle RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter

user32

SetProcessDPIAware FindWindowA GetForegroundWindow GetDesktopWindow GetShellWindow GetWindowThreadProcessId

shell32

SHGetFolderPathA ShellExecuteExA

advapi32

AdjustTokenPrivileges CreateProcessAsUserA SetTokenInformation AllocateAndInitializeSid LookupPrivilegeValueA OpenProcessToken FreeSid CheckTokenMembership DuplicateTokenEx

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

secur32

DeleteSecurityContext AcquireCredentialsHandleA InitializeSecurityContextA QueryContextAttributesA ApplyControlToken FreeContextBuffer FreeCredentialsHandle DecryptMessage EncryptMessage

Name

.text

Size

475KB

Virtual Size

474KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8.9MB

Virtual Size

8.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_d46f99ca38bf9b2b08d41b6fdd30855d_cobalt-strike_coinminer_icedid_njrat_satacom_stealc

ws2_32

winhttp

kernel32

user32

shell32

advapi32

wtsapi32

userenv

secur32

generic