2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.2MB
Sample260731-aymkhsab35
SHA256 5e7e58c025a5b613103ed53c6a9c6ea8d0b3bfb58eaa92e911b1a83f3f36c71c
MD5 02a025e4068e128d8b4984f531884ba4
SHA1 e4ebc560e91a2dfcd03ef3b63c3e09d61977d14b
SHA512 d8736c0de3f86b2fb76dde1f59bcd6b756f51fc20aff47b906357af513304d795e7d67f2710a9faf86849849f915bdbb2502590848be29bda086d2033d563ae7
SSDEEP 24576:YXBudxWZQZLZG4e9LEr7II1ReXHXVxI9Xozsr8zbhN6GwXOGIh4:8uA4KEr7UyXozsr8zlLwJIh
TLSH
T12045C056B3E401ECF1B79678DA611512FBB27886473097EF13A016570F3BAE44E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.2MB

2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 0227176b1cbeb6a539081a6a3954eb87
SHA256 5e7e58c025a5b613103ed53c6a9c6ea8d0b3bfb58eaa92e911b1a83f3f36c71c
MD5 02a025e4068e128d8b4984f531884ba4
SHA1 e4ebc560e91a2dfcd03ef3b63c3e09d61977d14b
SHA512 d8736c0de3f86b2fb76dde1f59bcd6b756f51fc20aff47b906357af513304d795e7d67f2710a9faf86849849f915bdbb2502590848be29bda086d2033d563ae7
SSDEEP 24576:YXBudxWZQZLZG4e9LEr7II1ReXHXVxI9Xozsr8zbhN6GwXOGIh4:8uA4KEr7UyXozsr8zlLwJIh
TLSH
T12045C056B3E401ECF1B79678DA611512FBB27886473097EF13A016570F3BAE44E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

298272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

diagnostics64.pdb

kernel32

VerSetConditionMask GetCurrentProcessId CloseHandle SetUnhandledExceptionFilter SetDllDirectoryW SetThreadErrorMode LoadLibraryA GetSystemDirectoryW GetTempPathW GetTempFileNameW GetModuleHandleW QueryPerformanceFrequency CreateToolhelp32Snapshot Module32FirstW Module32NextW Process32FirstW OpenProcess QueryFullProcessImageNameW Process32NextW HeapAlloc GetProcessHeap HeapFree Sleep WaitForSingleObject GetExitCodeProcess ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead DeviceIoControl GetLastError CreateProcessW LocalFree FormatMessageW TerminateProcess RegisterWaitForSingleObject UnregisterWaitEx CancelSynchronousIo ReadFile WriteFile VerifyVersionInfoW HeapSize GetTimeZoneInformation HeapReAlloc SetStdHandle OutputDebugStringW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW GetFileSizeEx SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteConsoleW GetFileType IsProcessorFeaturePresent GetStdHandle GetModuleHandleExW ExitProcess GetDriveTypeW FlsFree FlsSetValue GetCurrentThreadId CreateFileW LoadLibraryExW VirtualQuery GetLongPathNameW GetModuleFileNameW FreeLibrary GetProcAddress WideCharToMultiByte LoadLibraryW GetCurrentProcess MultiByteToWideChar SetEndOfFile FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetCPInfo LCMapStringEx FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW GetFullPathNameW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime GetStringTypeW WaitForSingleObjectEx GetExitCodeThread WakeConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer RtlUnwind

user32

GetDesktopWindow GetWindowRect GetWindowLongW GetWindowTextW EnumChildWindows SendMessageW SetWindowLongPtrW GetDlgItem SetTimer PostMessageW GetWindowLongPtrW GetAncestor GetClassNameW MessageBoxW wsprintfW IsWindow EnableWindow DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW SystemParametersInfoW PostQuitMessage CreateDialogParamW ShowWindow SetWindowPos GetSystemMetrics DestroyWindow

shell32

SHCreateItemFromParsingName SHGetKnownFolderPath ShellExecuteW

ole32

CoInitializeEx OleUninitialize OleInitialize CoCreateGuid CoCreateInstance CoTaskMemFree CoUninitialize

advapi32

GetUserNameW RegQueryValueExW RegGetValueW RegEnumValueW RegEnumKeyExA RegQueryInfoKeyW RegCloseKey RegSetValueExW RegOpenKeyExW

psapi

GetModuleInformation

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

489KB

Virtual Size

488KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

137KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_02a025e4068e128d8b4984f531884ba4_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

shell32

ole32

advapi32

psapi

version

generic