2026-07-22_d52cba4549d4831016092f00bb6af59c_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_d52cba4549d4831016092f00bb6af59c_cobalt-strike_icedid_njrat_satacom_stealc
Size 364KB
Sample260722-vgq7layhnd
SHA256 b72cc5e9757faa32754af218e58da9da489ab7784a1f91d4afb1ed874f66d582
MD5 d52cba4549d4831016092f00bb6af59c
SHA1 9a732aef34225d1d28f48f38be4e87207f6f05f5
SHA512 03db0656a49d732f79b7cea9c4d316bb2e0b743cb5cf48330dd9978399750115cd6fbcf6d40e084d915c2398ea5291e683f6f6afc6dc6b0db847566ec41c5d15
SSDEEP 6144:z/0mfCT8Q4D/NPPrmLQ6qvWvWzdcdns+k7Suo+XNPFh0wrGg:z/DkiKqzUpktlFh0wz
TLSH
T16D844A06EA9500E6F726C3389983D911DA727C254760E6CF93707A763E33AD24E3B319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_d52cba4549d4831016092f00bb6af59c_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-22_d52cba4549d4831016092f00bb6af59c_cobalt-strike_icedid_njrat_satacom_stealc

.exe 364KB

2026-07-22_d52cba4549d4831016092f00bb6af59c_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 0ab5ccfcc0b13940b4d10b2be3b79873
SHA256 b72cc5e9757faa32754af218e58da9da489ab7784a1f91d4afb1ed874f66d582
MD5 d52cba4549d4831016092f00bb6af59c
SHA1 9a732aef34225d1d28f48f38be4e87207f6f05f5
SHA512 03db0656a49d732f79b7cea9c4d316bb2e0b743cb5cf48330dd9978399750115cd6fbcf6d40e084d915c2398ea5291e683f6f6afc6dc6b0db847566ec41c5d15
SSDEEP 6144:z/0mfCT8Q4D/NPPrmLQ6qvWvWzdcdns+k7Suo+XNPFh0wrGg:z/DkiKqzUpktlFh0wz
TLSH
T16D844A06EA9500E6F726C3389983D911DA727C254760E6CF93707A763E33AD24E3B319
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

99280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\MultiCommander_Trunk\BuildOutput\Output\x64\Release v143\MCAdmin\MCAdmin.pdb

kernel32

UnmapViewOfFile GetCurrentThreadId IsBadWritePtr IsBadReadPtr ReleaseMutex CreateMutexW OpenMutexW OpenEventW LoadLibraryExW DisableThreadLibraryCalls InitializeCriticalSectionEx InitializeCriticalSection GetModuleHandleW lstrcmpiW MultiByteToWideChar SizeofResource LoadResource FindResourceW GetModuleFileNameW RaiseException DecodePointer LockResource FindResourceExW VerifyVersionInfoW VerSetConditionMask SetLastError MoveFileExW SetFileTime DeleteFileW CreateDirectoryW RemoveDirectoryW SetFileAttributesW WriteFile LocalFree WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetStringTypeW SetStdHandle CreateFileMappingW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType LCMapStringW GetStdHandle ExitProcess IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread VirtualQuery VirtualProtect GetSystemInfo FlsFree FlsSetValue FlsGetValue FlsAlloc MapViewOfFile HeapDestroy OpenFileMappingW CreateFileW CreateEventW SetEvent LeaveCriticalSection EnterCriticalSection DeleteCriticalSection FlushViewOfFile SwitchToThread Sleep GetTickCount GetWindowsDirectoryW GetSystemDirectoryW QueryDosDeviceW TerminateThread WaitForSingleObject GetCurrentProcessId OpenProcess DuplicateHandle FreeLibrary GetProcAddress LoadLibraryW CloseHandle GetCurrentThread GetCurrentProcess GetLastError GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList RtlUnwind

user32

KillTimer RedrawWindow UnregisterClassW SetTimer MessageBoxW PostMessageW GetMonitorInfoW MonitorFromPoint CreatePopupMenu DestroyMenu TrackPopupMenuEx AppendMenuW GetMenuItemCount RemoveMenu GetMenuItemInfoW GetWindowRect InvalidateRect CreateWindowExW SetWindowPos MessageBeep IsWindow PtInRect PeekMessageW MapWindowPoints LoadCursorW GetClassInfoExW LoadImageW GetSystemMetrics RegisterClassExW DrawTextW LoadAcceleratorsW LoadMenuW SendMessageW SetFocus GetWindowLongW PostQuitMessage LoadStringA LoadStringW CallWindowProcW DefWindowProcW GetWindowLongPtrW SetWindowLongPtrW DestroyWindow DispatchMessageW TranslateMessage GetMessageW SetWindowTextW UpdateWindow ShowWindow CharNextW GetClientRect EndPaint BeginPaint

gdi32

DeleteObject CreateSolidBrush SelectObject GetClipBox PatBlt SaveDC RestoreDC GetStockObject SetBkMode SetTextColor

advapi32

EnumDependentServicesW SetNamedSecurityInfoW GetNamedSecurityInfoW RegQueryValueExW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW LookupPrivilegeValueW QueryServiceStatus ControlService EnumServicesStatusExW CloseServiceHandle OpenServiceW OpenSCManagerW OpenThreadToken OpenProcessToken PrivilegeCheck AdjustTokenPrivileges

shell32

SHFileOperationW

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

oleaut32

VarUI4FromStr

shlwapi

SHDeleteKeyW SHCopyKeyW

userenv

UnloadUserProfile

Name

.text

Size

215KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_d52cba4549d4831016092f00bb6af59c_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

userenv

generic