2026-07-28_fb64a7dae1e87b34ed334e5753218ccd_cobalt-strike_icedid_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_fb64a7dae1e87b34ed334e5753218ccd_cobalt-strike_icedid_satacom_stealc
Size 329KB
Sample260729-abprcszbpg
SHA256 eb18e8d57918e9e69867eaccdc704e6e29e1a13e019f839a87c0c5ba4e5d4176
MD5 fb64a7dae1e87b34ed334e5753218ccd
SHA1 8ffb01f6868ca72aa8a872de48543e8b708a7b08
SHA512 ea90ed875cf070b5e2ea84621fb9050a56d1e3d31ded4381bc01f60c6bf860151719e89d78889e016f76345b040055167f63cf4be0c14017bc54287774936ca8
SSDEEP 6144:4t6OzE4li4H1oDCj9TbuIusfyBUeGS2hhTu3sRor5AQG5x+q7qB+:4PlPSDYPyBfvWhA6oC5K
TLSH
T155746B56F7A414FCE667C17CCA564946EB327C060771AACF13900A972E237E49E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_fb64a7dae1e87b34ed334e5753218ccd_cobalt-strike_icedid_satacom_stealc

File Explorer

2026-07-28_fb64a7dae1e87b34ed334e5753218ccd_cobalt-strike_icedid_satacom_stealc

.exe 329KB

2026-07-28_fb64a7dae1e87b34ed334e5753218ccd_cobalt-strike_icedid_satacom_stealc

IMPHASH a046f1d20f5da71a5e62ee18aecbae01
SHA256 eb18e8d57918e9e69867eaccdc704e6e29e1a13e019f839a87c0c5ba4e5d4176
MD5 fb64a7dae1e87b34ed334e5753218ccd
SHA1 8ffb01f6868ca72aa8a872de48543e8b708a7b08
SHA512 ea90ed875cf070b5e2ea84621fb9050a56d1e3d31ded4381bc01f60c6bf860151719e89d78889e016f76345b040055167f63cf4be0c14017bc54287774936ca8
SSDEEP 6144:4t6OzE4li4H1oDCj9TbuIusfyBUeGS2hhTu3sRor5AQG5x+q7qB+:4PlPSDYPyBfvWhA6oC5K
TLSH
T155746B56F7A414FCE667C17CCA564946EB327C060771AACF13900A972E237E49E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

109312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\fcl.dll\Desktop\100\x64\Release\100.pdb

kernel32

MultiByteToWideChar Sleep GetFileAttributesExW LocalFree ExitProcess CopyFileW WideCharToMultiByte GetConsoleWindow IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent SetEndOfFile WriteConsoleW HeapSize SetFileAttributesW FindClose FindNextFileA GetModuleFileNameW GetCurrentProcess CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW FindFirstFileExW GetOEMCP GetACP IsValidCodePage FindFirstFileA CompareFileTime CreateDirectoryW ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetStdHandle WriteFile GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree CloseHandle HeapReAlloc HeapAlloc VirtualProtect LoadLibraryExW CompareStringW RtlUnwind

user32

ShowWindow

advapi32

RegSetValueExW GetUserNameA RegCloseKey RegOpenKeyExW

shell32

ShellExecuteW SHGetFolderPathW

winhttp

WinHttpCrackUrl WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpConnect

crypt32

CryptStringToBinaryA CryptUnprotectData

bcrypt

BCryptDecrypt BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptDestroyKey

Name

.text

Size

219KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_fb64a7dae1e87b34ed334e5753218ccd_cobalt-strike_icedid_satacom_stealc

kernel32

user32

advapi32

shell32

winhttp

crypt32

bcrypt

generic