2026-07-23_aa2cd2ed84a21f63246ca58983ef7494_cobalt-strike_icedid_njrat_ryuk_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_aa2cd2ed84a21f63246ca58983ef7494_cobalt-strike_icedid_njrat_ryuk_satacom
Size 1.3MB
Sample260723-2mwslaybmd
SHA256 b18d1e513a5e290d2416f80e4fc843a3dbd31e0a2ef4c2c52486342e2405258f
MD5 aa2cd2ed84a21f63246ca58983ef7494
SHA1 a69c912f7f7f38a8464ca86277b9fe6f77b7ec29
SHA512 f5369626853bbb135cb2602cef30ed4ed1b5bbd6a576a850236bcbd8f84a0a3ff94ee3b43df4562f911813942edfb7af9f3b8404e24fb000c026c07f7ba988cb
SSDEEP 24576:c63YI4YnCOmuZQyAuD8yyZg1fgxLHsRF6BlzXyDOn:KI4YXpAusOxyLFB9yq
TLSH
T1FD55BF16E3E640E9DC75CB388A756722FA7178025E34A99F13D4432A3F73EA05E2DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_aa2cd2ed84a21f63246ca58983ef7494_cobalt-strike_icedid_njrat_ryuk_satacom

File Explorer

2026-07-23_aa2cd2ed84a21f63246ca58983ef7494_cobalt-strike_icedid_njrat_ryuk_satacom

.exe 1.3MB

2026-07-23_aa2cd2ed84a21f63246ca58983ef7494_cobalt-strike_icedid_njrat_ryuk_satacom

IMPHASH 917934d044f9a61c690a7d271f84984d
SHA256 b18d1e513a5e290d2416f80e4fc843a3dbd31e0a2ef4c2c52486342e2405258f
MD5 aa2cd2ed84a21f63246ca58983ef7494
SHA1 a69c912f7f7f38a8464ca86277b9fe6f77b7ec29
SHA512 f5369626853bbb135cb2602cef30ed4ed1b5bbd6a576a850236bcbd8f84a0a3ff94ee3b43df4562f911813942edfb7af9f3b8404e24fb000c026c07f7ba988cb
SSDEEP 24576:c63YI4YnCOmuZQyAuD8yyZg1fgxLHsRF6BlzXyDOn:KI4YXpAusOxyLFB9yq
TLSH
T1FD55BF16E3E640E9DC75CB388A756722FA7178025E34A99F13D4432A3F73EA05E2DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

507872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges ChangeServiceConfigA CloseServiceHandle CloseTrace ControlService ControlTraceA ConvertSecurityDescriptorToStringSecurityDescriptorA ConvertStringSecurityDescriptorToSecurityDescriptorA CreateServiceA DeleteService EnableTraceEx2 GetUserNameW InitializeSecurityDescriptor LookupPrivilegeValueA OpenProcessToken OpenSCManagerA OpenServiceA OpenTraceA ProcessTrace RegCloseKey RegCreateKeyExA RegGetKeySecurity RegOpenKeyA RegOpenKeyExA RegQueryValueExA RegSetKeySecurity RegSetValueA RegSetValueExA RegisterServiceCtrlHandlerExA SetSecurityDescriptorDacl SetServiceStatus StartServiceA StartServiceCtrlDispatcherA StartTraceA SystemFunction036

dinput8

DirectInput8Create

ws2_32

WSAGetLastError WSAPoll WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname htons inet_addr ioctlsocket listen recv recvfrom send sendto setsockopt socket

version

GetFileVersionInfoW VerQueryValueA

user32

BringWindowToTop CheckDlgButton CloseClipboard CreateDialogIndirectParamW CreateWindowExW DialogBoxIndirectParamW DialogBoxParamW DispatchMessageW EnableWindow EndDialog GetClassNameA GetClientRect GetClipboardData GetDlgItem GetDlgItemTextW GetForegroundWindow GetMessageW GetSubMenu GetSysColor GetSysColorBrush GetWindowLongPtrW GetWindowRect GetWindowTextW GetWindowThreadProcessId IsClipboardFormatAvailable IsDialogMessageW IsDlgButtonChecked LoadIconA LoadIconW LoadImageA LoadMenuIndirectW LoadStringW MapVirtualKeyExA MapWindowPoints MessageBoxTimeoutW MessageBoxW MoveWindow OpenClipboard PostMessageW PostQuitMessage ScreenToClient SendMessageW SetClassLongPtrW SetDlgItemTextW SetFocus SetForegroundWindow SetTimer SetWindowLongPtrW SetWindowTextW ShowWindow TrackPopupMenu TranslateMessage

ntdll

NtQueryInformationProcess NtQueryVirtualMemory NtReadVirtualMemory NtResumeProcess NtSuspendProcess NtTerminateProcess NtUnmapViewOfSection RtlCaptureContext RtlCaptureStackBackTrace RtlCrc64 RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind

oleaut32

SysAllocString SysFreeString

ole32

CoAllowSetForegroundWindow CoCreateInstance CoInitialize CoInitializeEx CoInitializeSecurity CoUninitialize

comctl32

InitCommonControlsEx

shell32

DragAcceptFiles DragFinish DragQueryFileA ShellExecuteA ord71 Shell_NotifyIconW

dbghelp

SymGetSymFromAddr64 SymInitialize

tdh

TdhGetEventInformation

gdi32

DeleteObject SetBkColor SetTextColor

iphlpapi

GetTcpTable2 SetTcpEntry

wininet

HttpAddRequestHeadersA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetReadFile InternetSetOptionA

kernel32

CloseHandle CompareStringW CopyFileA CreateDirectoryA CreateDirectoryExA CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreatePipe CreateProcessA CreateRemoteThread CreateThread CreateToolhelp32Snapshot CreateWaitableTimerA DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetExitCodeThread GetFileAttributesA GetFileAttributesExW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetStartupInfoA GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTimeZoneInformation GetUserDefaultUILanguage GlobalLock GlobalUnlock HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsBadWritePtr IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsWow64Process2 K32EnumProcessModulesEx K32EnumProcesses K32GetModuleFileNameExA LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree LockFile LockFileEx MapViewOfFile MapViewOfFileEx MoveFileA MoveFileExW MultiByteToWideChar OpenMutexA OpenProcess OutputDebugStringW Process32First Process32Next QueryFullProcessImageNameW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseMutex SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointer SetFilePointerEx SetLastError SetPriorityClass SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer SignalObjectAndWait Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnlockFile UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

Name

.text

Size

665KB

Virtual Size

664KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

146KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

26.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

25B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

472KB

Virtual Size

471KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_aa2cd2ed84a21f63246ca58983ef7494_cobalt-strike_icedid_njrat_ryuk_satacom

advapi32

dinput8

ws2_32

version

user32

ntdll

oleaut32

ole32

comctl32

shell32

dbghelp

tdh

gdi32

iphlpapi

wininet

kernel32

generic