2026-07-29_a182f67c7f268f574d9e9c93727f5e21_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_a182f67c7f268f574d9e9c93727f5e21_cobalt-strike_icedid_njrat_satacom_stealc
Size 253KB
Sample260729-ms49lasalg
SHA256 43bd19909fecb231ea41a21d1db6434494644d1d423f4418a96d3ad6795830ac
MD5 a182f67c7f268f574d9e9c93727f5e21
SHA1 65ddebf8fef0b8ffdf21599abd820c203c71eb36
SHA512 c5447d7df76c2175f3719ffb0ee81bae4afab046a5490bd70d2f71545e56fb4b5ada587ebd64a62175d6c55c2e5d93bb2087c2886fe4d0506449a454ed09e46d
SSDEEP 3072:MA8ksYp2UBWSMQ6NnM8FSv9VkyRTOtJsbcZRoGXY6GraOPuI/immzARgpMY:MA8ksYp2UBWSMnm8W9xwKCoGXsP2zRW
TLSH
T140446C19E6A408FDE977C6BDDD534902EA727C4A0731E9DF039009A61F176D48E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_a182f67c7f268f574d9e9c93727f5e21_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-29_a182f67c7f268f574d9e9c93727f5e21_cobalt-strike_icedid_njrat_satacom_stealc

.exe 253KB

2026-07-29_a182f67c7f268f574d9e9c93727f5e21_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 44ce79bc12442bf843be49b20c800c45
SHA256 43bd19909fecb231ea41a21d1db6434494644d1d423f4418a96d3ad6795830ac
MD5 a182f67c7f268f574d9e9c93727f5e21
SHA1 65ddebf8fef0b8ffdf21599abd820c203c71eb36
SHA512 c5447d7df76c2175f3719ffb0ee81bae4afab046a5490bd70d2f71545e56fb4b5ada587ebd64a62175d6c55c2e5d93bb2087c2886fe4d0506449a454ed09e46d
SSDEEP 3072:MA8ksYp2UBWSMQ6NnM8FSv9VkyRTOtJsbcZRoGXY6GraOPuI/immzARgpMY:MA8ksYp2UBWSMnm8W9xwKCoGXsP2zRW
TLSH
T140446C19E6A408FDE977C6BDDD534902EA727C4A0731E9DF039009A61F176D48E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

65296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpReadData WinHttpConnect WinHttpOpen

crypt32

CryptStringToBinaryA

user32

GetMessageW LoadCursorA GetParent FillRect AdjustWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RedrawWindow UpdateWindow EnableWindow GetKeyState SetFocus IsWindowVisible ShowWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW PostMessageW SendMessageW SendMessageA DispatchMessageW TranslateMessage

gdi32

CreateSolidBrush DeleteObject SetTextColor SetDCBrushColor SetBkColor GetStockObject

advapi32

RegQueryValueExW CheckTokenMembership CryptDestroyHash CryptHashData CryptCreateHash CryptDecrypt CryptImportKey CryptGetHashParam CryptSetKeyParam FreeSid RegCloseKey CryptDestroyKey CryptReleaseContext CryptAcquireContextA RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegDeleteValueW AllocateAndInitializeSid

shell32

ShellExecuteW CommandLineToArgvW

iphlpapi

GetAdaptersInfo

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap SetStdHandle GetStringTypeW SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW IsValidCodePage FindNextFileW FindFirstFileExW GetCPInfo WriteProcessMemory GetCommandLineW CreateFileW DeleteFileW GetVolumeInformationW WriteFile CloseHandle WaitForSingleObject Sleep ExitProcess TerminateProcess CreateThread ResumeThread CreateProcessW GetThreadContext SetThreadContext GetSystemDirectoryW VirtualAllocEx GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryA LocalFree GetComputerNameW MultiByteToWideChar WideCharToMultiByte SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead FindClose RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess FreeLibrary GetModuleHandleExW GetStdHandle IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType

Name

.text

Size

170KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_a182f67c7f268f574d9e9c93727f5e21_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

crypt32

user32

gdi32

advapi32

shell32

iphlpapi

kernel32

generic