2026-07-29_65c6eca060484d7b673bde64e36e873a_cobalt-strike_icedid_njrat_satacom

General

Target
2026-07-29_65c6eca060484d7b673bde64e36e873a_cobalt-strike_icedid_njrat_satacom
Size 558KB
Sample260729-kap1vafb97
SHA256 47396f2f6119c8c8bd88700932238adf6ac54d34d565a4bc80d6de85967a80ef
MD5 65c6eca060484d7b673bde64e36e873a
SHA1 ffb1b55a93eb95bda7428d5f0eb1ed3939287843
SHA512 d45c3eeeb543fbf9aee9cff5b1eb4393c114cfdaf4970dedfb07452d63db30d2c837abd9b62f8afa43bb6860f9c4abced3ae4454652af866b9a7d34389056391
SSDEEP 12288:QONpoqEkZZEtSuxjqhWkBF8d3aym+TSAaN:PRZGkzvmayH+
TLSH
T1EBC47C55B6A400F9E177C578CA534D06EA72FC1647A1A6CF03A04B9A2F277E09F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_65c6eca060484d7b673bde64e36e873a_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-07-29_65c6eca060484d7b673bde64e36e873a_cobalt-strike_icedid_njrat_satacom

.exe 558KB

2026-07-29_65c6eca060484d7b673bde64e36e873a_cobalt-strike_icedid_njrat_satacom

IMPHASH 7a85a1a2a902ed3e178ea20ed608299f
SHA256 47396f2f6119c8c8bd88700932238adf6ac54d34d565a4bc80d6de85967a80ef
MD5 65c6eca060484d7b673bde64e36e873a
SHA1 ffb1b55a93eb95bda7428d5f0eb1ed3939287843
SHA512 d45c3eeeb543fbf9aee9cff5b1eb4393c114cfdaf4970dedfb07452d63db30d2c837abd9b62f8afa43bb6860f9c4abced3ae4454652af866b9a7d34389056391
SSDEEP 12288:QONpoqEkZZEtSuxjqhWkBF8d3aym+TSAaN:PRZGkzvmayH+
TLSH
T1EBC47C55B6A400F9E177C578CA534D06EA72FC1647A1A6CF03A04B9A2F277E09F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

428464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

RtlPcToFileHeader WriteConsoleW CreateFileW HeapSize WideCharToMultiByte ExpandEnvironmentStringsW CloseHandle WaitForSingleObject GetLastError CreateProcessW GetModuleHandleW FormatMessageA LocalFree GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar EncodePointer DecodePointer GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LCMapStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetStdHandle RtlLookupFunctionEntry RtlUnwindEx RtlUnwind RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap

Name

.text

Size

535KB

Virtual Size

534KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_65c6eca060484d7b673bde64e36e873a_cobalt-strike_icedid_njrat_satacom

version

kernel32

generic