2026-07-27_173c8e56a48713293bbad8c68ec0c7b8_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_173c8e56a48713293bbad8c68ec0c7b8_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.3MB
Sample260727-dbgbrsha67
SHA256 deb0460ab1112d7e8f4a25ccac678e7f8cc498658a5d34214c5c2017c7269331
MD5 173c8e56a48713293bbad8c68ec0c7b8
SHA1 8cb2660b3feacb78d3c44b138f471fac9a8d5d39
SHA512 07ae29ee2b5454ef2bdb51d810eeb3a20948b269c8fe08b1dde166673ee189c7456d76f4bcb6be845f5506db5ddfac3f03a61feb5460d1f2db6d8ff6535238b8
SSDEEP 24576:7s2tPWTy7Udkf8eSfaNcZgyKWoAploPAdYy8mjLVI/t0gZMi04nj:DtuTyUeSk03oPAdFjxIOS04nj
TLSH
T1E755AE85F2A501F8C16BC138CA869A1BE775740903315BEB17F04B6A7F63BE15B7A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_173c8e56a48713293bbad8c68ec0c7b8_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-27_173c8e56a48713293bbad8c68ec0c7b8_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.3MB

2026-07-27_173c8e56a48713293bbad8c68ec0c7b8_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 5e73e9c5a4b4b552125700f8ecc583a4
SHA256 deb0460ab1112d7e8f4a25ccac678e7f8cc498658a5d34214c5c2017c7269331
MD5 173c8e56a48713293bbad8c68ec0c7b8
SHA1 8cb2660b3feacb78d3c44b138f471fac9a8d5d39
SHA512 07ae29ee2b5454ef2bdb51d810eeb3a20948b269c8fe08b1dde166673ee189c7456d76f4bcb6be845f5506db5ddfac3f03a61feb5460d1f2db6d8ff6535238b8
SSDEEP 24576:7s2tPWTy7Udkf8eSfaNcZgyKWoAploPAdYy8mjLVI/t0gZMi04nj:DtuTyUeSk03oPAdFjxIOS04nj
TLSH
T1E755AE85F2A501F8C16BC138CA869A1BE775740903315BEB17F04B6A7F63BE15B7A321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

878800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

kernel32

QueryPerformanceFrequency CloseHandle GetProcAddress QueryPerformanceCounter AllocConsole OpenProcess CreateToolhelp32Snapshot Process32NextW Module32FirstW ReadProcessMemory GetModuleHandleW GetTickCount64 MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA FreeLibrary CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetConsoleOutputCP FlushFileBuffers ReadConsoleW GetConsoleMode SetFilePointerEx GetFileType GetCurrentThread LCMapStringW CompareStringW LoadLibraryExW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA TerminateProcess ExitProcess GetCurrentProcess GetModuleFileNameW WriteFile GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection RtlUnwind EncodePointer Sleep GetModuleHandleA SetThreadPriority SetEnvironmentVariableW FlsFree FlsSetValue FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo FlsGetValue FlsAlloc SetLastError GetOEMCP SetStdHandle GetStringTypeW CreateFileW SetEndOfFile HeapSize WriteConsoleW GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetLastError WakeAllConditionVariable GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException GetACP

user32

FindWindowW GetCursorPos SendInput GetAsyncKeyState GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowLongW DefWindowProcW GetWindowRect DestroyWindow SetWindowPos CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow IsWindow DispatchMessageW PeekMessageW GetForegroundWindow SetLayeredWindowAttributes TranslateMessage SetWindowLongW PostQuitMessage UpdateWindow PostMessageW

shell32

ShellExecuteW

winmm

timeBeginPeriod timeEndPeriod

wininet

InternetSetOptionA InternetOpenA InternetCloseHandle InternetReadFile InternetOpenUrlA

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

1019KB

Virtual Size

1018KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

279KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_173c8e56a48713293bbad8c68ec0c7b8_cobalt-strike_icedid_njrat_satacom_stealc

d3d11

dwmapi

kernel32

user32

shell32

winmm

wininet

imm32

d3dcompiler_47

generic