2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom
Size 545KB
Sample260729-la9wpazgra
SHA256 a819006f0b8f3e171eabc876917836f32205432e1500d84cdfdf37417f3f7c97
MD5 eeb6ff941303c29d0b2a258381bfcdca
SHA1 379fe85a45a2371cc024306087108d74e463e901
SHA512 8f13d62a5e3441cf00a8c9b4cc386917fd4d0ae05bb580cd1fb1fb63497e9b18a7934abbd5ee28f2c2c7019b70c5bdb39eeaa4f7aabe2ad582a26a5bcab1d345
SSDEEP 6144:8AbSF29mAaJp2SPipYUbYIM7YERvGNPy14ffpJbnMeNXsuedRrUzyxIDHxNitAlN:CHlPie5kU4fBVLs/CzHTritYiBzFOvL
TLSH
T1D8C47D25B65900FEE163D1B8CE175903F6B2788603709FEB0384A9A61F776D85A3BF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

detects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom

.exe 545KB

2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom

IMPHASH ffe7e889add217554a8459ecadf48dab
SHA256 a819006f0b8f3e171eabc876917836f32205432e1500d84cdfdf37417f3f7c97
MD5 eeb6ff941303c29d0b2a258381bfcdca
SHA1 379fe85a45a2371cc024306087108d74e463e901
SHA512 8f13d62a5e3441cf00a8c9b4cc386917fd4d0ae05bb580cd1fb1fb63497e9b18a7934abbd5ee28f2c2c7019b70c5bdb39eeaa4f7aabe2ad582a26a5bcab1d345
SSDEEP 6144:8AbSF29mAaJp2SPipYUbYIM7YERvGNPy14ffpJbnMeNXsuedRrUzyxIDHxNitAlN:CHlPie5kU4fBVLs/CzHTritYiBzFOvL
TLSH
T1D8C47D25B65900FEE163D1B8CE175903F6B2788603709FEB0384A9A61F776D85A3BF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

204608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

OpenProcess SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetLastError Process32NextW K32GetProcessMemoryInfo CreateFileA FileTimeToSystemTime GetDiskFreeSpaceExW LockResource QueryPerformanceFrequency DeleteFileA GlobalAlloc DeleteFileW Process32FirstW GlobalFree CloseHandle K32GetModuleBaseNameA GetSystemInfo LoadResource FindResourceW SetFileAttributesA FileTimeToLocalFileTime K32EnumProcesses GetWindowsDirectoryW GetProcAddress GlobalLock SetFilePointerEx LocalFree MoveFileExW GetFileSize ExitProcess GetCurrentProcessId GlobalMemoryStatusEx CreateProcessW GetModuleHandleW CopyFileW WideCharToMultiByte CreateProcessA GetSystemDirectoryW GetDiskFreeSpaceExA QueryPerformanceCounter GetTickCount GlobalUnlock IsDebuggerPresent GetComputerNameA FlushFileBuffers WriteConsoleW GetConsoleMode GetConsoleOutputCP HeapReAlloc HeapSize GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW LoadLibraryExW GetFileType GetFileAttributesW CreateFileW WaitForSingleObject FindClose CreateMutexW GetTempPathW PeekNamedPipe GetSystemTimes CreatePipe GetModuleFileNameW TerminateProcess VirtualAlloc DeviceIoControl WriteFile GetCurrentProcess FindNextFileW VirtualFree VirtualProtect SetHandleInformation FindFirstFileW GetLogicalDrives GetVolumeInformationW SizeofResource K32EnumProcessModules ReadFile HeapAlloc HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable ReleaseSRWLockExclusive AcquireSRWLockExclusive

user32

SetClipboardData SetWindowsHookExW GetClipboardData TranslateMessage EnumWindows UnhookWindowsHookEx GetMonitorInfoA BlockInput GetWindowTextA ExitWindowsEx EmptyClipboard ToUnicode DispatchMessageW OpenClipboard GetAsyncKeyState IsWindow ShowWindow GetSystemMetrics CallNextHookEx EnumDisplayMonitors MessageBoxW SwapMouseButton SetForegroundWindow ReleaseDC SendInput GetMessageW IsWindowVisible GetDC GetLastInputInfo PostMessageW GetKeyState CloseClipboard

gdi32

SelectObject CreateCompatibleDC StretchBlt DeleteDC SetDIBits SetStretchBltMode DeleteObject CreateCompatibleBitmap

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey SetFileSecurityW RegDeleteKeyW GetUserNameA RegCreateKeyExW RegDeleteTreeW RegSetValueExW OpenProcessToken RegOpenKeyExW RegDeleteValueW ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW GetTokenInformation

shell32

SHGetFolderPathW ShellExecuteExW

ole32

CoTaskMemFree CreateStreamOnHGlobal CoSetProxyBlanket CoInitializeEx PropVariantClear CoUninitialize CoCreateInstance

oleaut32

VariantClear SysAllocString VariantInit SysFreeString

ws2_32

WSAIoctl WSACleanup closesocket select inet_pton getaddrinfo WSAStartup setsockopt freeaddrinfo htons recv connect socket send

gdiplus

GdipGetImageEncoders GdipCloneImage GdipAlloc GdipDrawImageRectI GdipCreateBitmapFromHBITMAP GdiplusShutdown GdipGetImageEncodersSize GdipCreateBitmapFromScan0 GdipSaveImageToStream GdipDeleteGraphics GdiplusStartup GdipGetImageGraphicsContext GdipFree GdipSetInterpolationMode GdipDisposeImage

winmm

waveInGetNumDevs waveInGetDevCapsW

Name

.text

Size

329KB

Virtual Size

329KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_eeb6ff941303c29d0b2a258381bfcdca_cobalt-strike_icedid_njrat_satacom

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ws2_32

gdiplus

winmm

generic