2026-07-21_6f821498a8313d6c62612c1a0bf052be_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-21_6f821498a8313d6c62612c1a0bf052be_cobalt-strike_icedid_njrat_satacom_stealc
Size 16.8MB
Sample260721-1l7yssvbmd
SHA256 5ae811a06c8590226c2a2c4f1fd6d66fb0ba1ec547528495939af547ce42d555
MD5 6f821498a8313d6c62612c1a0bf052be
SHA1 a2cf838795d75ae6e0f538c8f17ef49b9fc3ee5d
SHA512 357859d8c28971ce208e3b74b45a4703c26917168de18bcf266614d064629c48515bbe0e4f41ed7a7f6291b4370e906c318138e5bce6c3f7327b12b99b3a8895
SSDEEP 393216:cGdcptVS2I92h7AQJiN/5dcptVS2I92h7AQJOR:Fd2tV5I9dYg5d2tV5I9dYO
TLSH
T1B007221572F810ACF0769134C5AA661BD7727C6617319ADF13E4096A2F37BF00ABB722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-21_6f821498a8313d6c62612c1a0bf052be_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-21_6f821498a8313d6c62612c1a0bf052be_cobalt-strike_icedid_njrat_satacom_stealc

.exe 16.8MB

2026-07-21_6f821498a8313d6c62612c1a0bf052be_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 2dbd3565cdb5e2eb135b05517fe967be
SHA256 5ae811a06c8590226c2a2c4f1fd6d66fb0ba1ec547528495939af547ce42d555
MD5 6f821498a8313d6c62612c1a0bf052be
SHA1 a2cf838795d75ae6e0f538c8f17ef49b9fc3ee5d
SHA512 357859d8c28971ce208e3b74b45a4703c26917168de18bcf266614d064629c48515bbe0e4f41ed7a7f6291b4370e906c318138e5bce6c3f7327b12b99b3a8895
SSDEEP 393216:cGdcptVS2I92h7AQJiN/5dcptVS2I92h7AQJOR:Fd2tV5I9dYg5d2tV5I9dYO
TLSH
T1B007221572F810ACF0769134C5AA661BD7727C6617319ADF13E4096A2F37BF00ABB722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

557280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

PostQuitMessage UnregisterClassA RegisterClassExA CreateWindowExA PeekMessageA ShowWindow IsWindowVisible IsIconic GetAsyncKeyState GetKeyNameTextA DefWindowProcA DispatchMessageA DestroyWindow TrackMouseEvent mouse_event ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TranslateMessage GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard FindWindowA MessageBoxA LoadIconA LoadCursorA GetWindowThreadProcessId EnumWindows GetParent ScreenToClient GetWindowTextA GetForegroundWindow UpdateWindow MapVirtualKeyA

kernel32

GetTimeZoneInformation GetOEMCP GetACP IsValidCodePage HeapReAlloc OutputDebugStringW ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapAlloc HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext WriteFile IsProcessorFeaturePresent WriteConsoleW GetFileType GetStdHandle ReadFile FreeLibraryAndExitThread ExitThread CreateDirectoryA CreateFileA OutputDebugStringA CloseHandle GetLastError WaitForSingleObject CreateMutexA Sleep CreateRemoteThread GetProcessHeap GetCommandLineA GetTickCount64 VirtualAllocEx WriteProcessMemory MapViewOfFile VirtualFreeEx FlushViewOfFile UnmapViewOfFile GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetProcAddress CreateFileMappingA CreateToolhelp32Snapshot Process32FirstW Process32NextW IsDebuggerPresent CheckRemoteDebuggerPresent GetCurrentProcess Process32First Process32Next GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA CreateThread TerminateProcess ExitProcess FlsFree FlsSetValue FlsGetValue SetStdHandle CreateFileW FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW OpenProcess SetEnvironmentVariableW HeapSize SetEndOfFile CreateProcessA LocalFree InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW RtlUnwind FormatMessageA GetLocaleInfoEx GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 AreFileApisANSI GetModuleHandleW CopyFile2 GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter

shell32

SHGetFolderPathA ShellExecuteA

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

wininet

HttpQueryInfoA InternetReadFile InternetOpenA InternetCloseHandle InternetOpenUrlA

ole32

CoInitializeEx

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

760KB

Virtual Size

760KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15.9MB

Virtual Size

15.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-21_6f821498a8313d6c62612c1a0bf052be_cobalt-strike_icedid_njrat_satacom_stealc

user32

kernel32

shell32

d3d11

d3dcompiler_47

wininet

ole32

imm32

generic