2026-07-20_b5425ee9460af4497c2b1ee968dccf0f_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-07-20_b5425ee9460af4497c2b1ee968dccf0f_cobalt-strike_icedid_njrat_satacom_stealc
Size 185KB
Sample260720-p39ceacy9s
SHA256 b17ef89ae9c92fedc7246ea783289ae84eea2c02d026c38e804b38febd23e7b7
MD5 b5425ee9460af4497c2b1ee968dccf0f
SHA1 df4f0a2d42369d6c58ba3b6d9e1e5396c15c57e5
SHA512 de2a78988a9fc5da4c01767f7301cb45f616e425060a39cb7572bc9a08fbdc7457d8e9c08169424ac164bbb835f9595e2c2087588923870f9b13783258b60d85
SSDEEP 3072:/3TycsredvAADQgw4fhYGUoswqkiy8lN5VuGV8E7vMVL:/mGX55mDJTuQ0
TLSH
T149045C45B3E510F9E1738279C9A11606F773781507609BEF43A087B6AF277D0AD3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_b5425ee9460af4497c2b1ee968dccf0f_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-20_b5425ee9460af4497c2b1ee968dccf0f_cobalt-strike_icedid_njrat_satacom_stealc

.exe 185KB

2026-07-20_b5425ee9460af4497c2b1ee968dccf0f_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 75c4769a1acae7f6af85763b8ece2f59
SHA256 b17ef89ae9c92fedc7246ea783289ae84eea2c02d026c38e804b38febd23e7b7
MD5 b5425ee9460af4497c2b1ee968dccf0f
SHA1 df4f0a2d42369d6c58ba3b6d9e1e5396c15c57e5
SHA512 de2a78988a9fc5da4c01767f7301cb45f616e425060a39cb7572bc9a08fbdc7457d8e9c08169424ac164bbb835f9595e2c2087588923870f9b13783258b60d85
SSDEEP 3072:/3TycsredvAADQgw4fhYGUoswqkiy8lN5VuGV8E7vMVL:/mGX55mDJTuQ0
TLSH
T149045C45B3E510F9E1738279C9A11606F773781507609BEF43A087B6AF277D0AD3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

27024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

DispatchMessageA FillRect ReleaseDC GetDC GetSystemMetrics GetAsyncKeyState SetLayeredWindowAttributes UpdateLayeredWindow ShowWindow DestroyWindow CreateWindowExA RegisterClassExA PostQuitMessage DefWindowProcA PeekMessageA TranslateMessage

gdi32

TextOutA MoveToEx SetTextColor SetBkMode SelectObject SelectClipRgn LineTo CreateCompatibleBitmap CreateCompatibleDC CreateFontA CreatePen CreateRectRgn CreateRoundRectRgn CreateSolidBrush DeleteDC DeleteObject Ellipse FillRgn

advapi32

QueryServiceStatus OpenServiceA OpenSCManagerA DeleteService ControlService CloseServiceHandle

kernel32

FreeEnvironmentStringsW GetProcessHeap SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetEnvironmentStringsW HeapSize HeapReAlloc CreateFileW WriteConsoleW GetModuleHandleW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency Sleep TerminateProcess OpenProcess GetTickCount64 VirtualProtect GetModuleHandleA GetProcAddress CreateToolhelp32Snapshot Process32First Process32Next GetLastError GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead MultiByteToWideChar RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess ExitProcess GetModuleFileNameW GetStdHandle WriteFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter WideCharToMultiByte HeapFree HeapAlloc GetFileType LoadLibraryExW LCMapStringW SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW

Name

.text

Size

115KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_b5425ee9460af4497c2b1ee968dccf0f_cobalt-strike_icedid_njrat_satacom_stealc

user32

gdi32

advapi32

kernel32

generic