2026-07-22_74082fe39f8d9bcf712fe9f2f5a5edae_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_74082fe39f8d9bcf712fe9f2f5a5edae_cobalt-strike_icedid_njrat_satacom_stealc
Size 18.7MB
Sample260722-v72e9aab23
SHA256 9f6bc4584ce41d0f8ba80cc6ac0316926a930dea39b0523936e59e4d3321503a
MD5 74082fe39f8d9bcf712fe9f2f5a5edae
SHA1 0b558d66f48415c2b2b4735f4eccef6b144e10a4
SHA512 d0470cc86160aa270bbb8ec436e0b3f52f31c8301efc00e3c418a02e9b7b507956320b9e4c95c3daa8ce939748d5f01175a7caaec38a70382b849f57c7e42efd
SSDEEP 393216:iJMR13D+8+LStQxwlyJoulyj2DF1gf54MmapjaD2qo9kB:iJMPR+L6Ty1ls2DF6f54apjc2qo9k
TLSH
T1C51712D9A6D552FCC422C430D44796E6F8A53C480E7A8CD7BFC63A402B328E5D87BB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_74082fe39f8d9bcf712fe9f2f5a5edae_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-22_74082fe39f8d9bcf712fe9f2f5a5edae_cobalt-strike_icedid_njrat_satacom_stealc

.exe 18.7MB

2026-07-22_74082fe39f8d9bcf712fe9f2f5a5edae_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH d1ce785f66798d2b9657f36898584179
SHA256 9f6bc4584ce41d0f8ba80cc6ac0316926a930dea39b0523936e59e4d3321503a
MD5 74082fe39f8d9bcf712fe9f2f5a5edae
SHA1 0b558d66f48415c2b2b4735f4eccef6b144e10a4
SHA512 d0470cc86160aa270bbb8ec436e0b3f52f31c8301efc00e3c418a02e9b7b507956320b9e4c95c3daa8ce939748d5f01175a7caaec38a70382b849f57c7e42efd
SSDEEP 393216:iJMR13D+8+LStQxwlyJoulyj2DF1gf54MmapjaD2qo9kB:iJMPR+L6Ty1ls2DF6f54apjc2qo9k
TLSH
T1C51712D9A6D552FCC422C430D44796E6F8A53C480E7A8CD7BFC63A402B328E5D87BB65
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

641328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\asus\Desktop\UCRobloxExternal_[unknowncheats.me]_ — kopia\UCRobloxExternal_[unknowncheats.me]_ — kopia\UCRobloxExternal\x64\Release\app.pdb

kernel32

LockResource Process32FirstW CloseHandle FreeConsole LoadResource FindResourceW Module32FirstW ExitProcess ReadProcessMemory GetModuleHandleW GetConsoleWindow Module32NextW CreateProcessA AllocConsole IsDebuggerPresent OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsValidCodePage HeapReAlloc GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetProcessId LCMapStringW CompareStringW GetTimeFormatW LoadLibraryExW VirtualProtect HeapFree HeapAlloc GetFileSizeEx GetFileType ReadConsoleW SetFilePointerEx UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext WriteFile GetModuleFileNameW IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead QueryFullProcessImageNameA Process32NextW GetConsoleMode Sleep TerminateProcess SetConsoleMode GetStdHandle GetCurrentProcess SetConsoleTitleA WriteProcessMemory SizeofResource GetModuleFileNameA GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW WakeAllConditionVariable LCMapStringEx DecodePointer RtlUnwind EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetExitCodeThread CreateToolhelp32Snapshot GetCommandLineA OpenProcess GetDateFormatW GetModuleHandleA GetLocaleInfoW ReadFile LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetLastError GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW WaitForSingleObjectEx

user32

SetForegroundWindow UpdateWindow SetLayeredWindowAttributes GetForegroundWindow SendInput SetProcessDPIAware PostQuitMessage GetClientRect SetWindowLongW FindWindowW TranslateMessage GetCursorPos FindWindowA GetWindowThreadProcessId MessageBoxA GetKeyState GetMessageExtraInfo GetCapture TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowLongW MapVirtualKeyA DefWindowProcW GetWindowRect DestroyWindow SetWindowPos SetActiveWindow SetWindowLongPtrW CreateWindowExW ScreenToClient GetSystemMetrics UnregisterClassW GetWindowLongPtrW RegisterClassExW ShowWindow GetKeyNameTextA GetAsyncKeyState DispatchMessageW GetCursorInfo ClientToScreen PeekMessageW GetWindowTextA SetWindowDisplayAffinity SetFocus

shell32

ShellExecuteA ShellExecuteW

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

841KB

Virtual Size

840KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

203KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17.7MB

Virtual Size

17.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_74082fe39f8d9bcf712fe9f2f5a5edae_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

shell32

d3d11

dwmapi

version

wininet

imm32

d3dcompiler_47

generic