2026-07-30_9666c459c8b4210b16800d7139a775e4_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_9666c459c8b4210b16800d7139a775e4_cobalt-strike_icedid_njrat_satacom_stealc
Size 790KB
Sample260730-qvmdcayere
SHA256 9f970babc77eccef3861bca74f55193ddc7646cfcf223c2b85bef25437ffef2a
MD5 9666c459c8b4210b16800d7139a775e4
SHA1 dab199fcde45ff53513cfe9938c70e3fc1bacf66
SHA512 d9d7770a655a75a40cea20e493af3209902c0999e6a97af899232a892ba4f037d205cc7ad97d348912de2ab00393bba55e3f5cec9cdaf786a5b37e87158cbabf
SSDEEP 12288:y7vb8Etqt/qlUf0pk5QnECyHhhiCWnnoQqQKO:xEnlUfGkynEnitnnfkO
TLSH
T1D605BF55F6F405ECE0379139C597AA0BFA76380907209ADF23E406A93F776E41E7A312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_9666c459c8b4210b16800d7139a775e4_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-30_9666c459c8b4210b16800d7139a775e4_cobalt-strike_icedid_njrat_satacom_stealc

.exe 790KB

2026-07-30_9666c459c8b4210b16800d7139a775e4_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 91b2ef1531ca61edcd12eb0ea0727d88
SHA256 9f970babc77eccef3861bca74f55193ddc7646cfcf223c2b85bef25437ffef2a
MD5 9666c459c8b4210b16800d7139a775e4
SHA1 dab199fcde45ff53513cfe9938c70e3fc1bacf66
SHA512 d9d7770a655a75a40cea20e493af3209902c0999e6a97af899232a892ba4f037d205cc7ad97d348912de2ab00393bba55e3f5cec9cdaf786a5b37e87158cbabf
SSDEEP 12288:y7vb8Etqt/qlUf0pk5QnECyHhhiCWnnoQqQKO:xEnlUfGkynEnitnnfkO
TLSH
T1D605BF55F6F405ECE0379139C597AA0BFA76380907209ADF23E406A93F776E41E7A312
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

377280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmSetWindowAttribute

kernel32

CreateMutexW GetModuleFileNameW MoveFileExW OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP GetLastError HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle GetModuleHandleExW TerminateProcess ExitProcess CloseHandle SetStdHandle CreateFileW GetCurrentProcess IsProcessorFeaturePresent HeapSize WriteConsoleW SetEndOfFile IsValidCodePage LeaveCriticalSection EnterCriticalSection RtlUnwind InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree ReadFile

user32

LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard EnumDisplaySettingsW ReleaseCapture SendMessageW LoadIconW LoadCursorW FindWindowW MessageBoxW SetForegroundWindow UpdateWindow GetSystemMetrics ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage

shell32

ShellExecuteW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

529KB

Virtual Size

529KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

162KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_9666c459c8b4210b16800d7139a775e4_cobalt-strike_icedid_njrat_satacom_stealc

d3d11

d3dcompiler_47

dwmapi

kernel32

user32

shell32

imm32

generic