2026-07-31_df35b9700fd3822d31906ab0a56ff5c3_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_df35b9700fd3822d31906ab0a56ff5c3_cobalt-strike_icedid_njrat_satacom_stealc
Size 741KB
Sample260731-krvbwsfg33
SHA256 9af40d6baf82443f7c905e3ef878dbc5978ee3578e94b7b20d5a82ecf3e103b8
MD5 df35b9700fd3822d31906ab0a56ff5c3
SHA1 2d6001f7b56e656b0627a3e772f41a82e47b7f63
SHA512 6a070d56901bb4230ffa102b0162ee741dd1da9da80baa9a9fff3612d0a45e17ad9fba1cc04934c715f52c7aa9c04534515a0fe4566b5fb30aa9117fc776c77b
SSDEEP 12288:yo9YOFx87kSFyZSkq9L5g9yCZ+rDYClURMku:z9YOFkkeyZST9L5g9y1VU
TLSH
T18FF49E29EBE902F8D1B7C675CE664516EBB278494370A6DF03D04A562F337D08A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_df35b9700fd3822d31906ab0a56ff5c3_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-31_df35b9700fd3822d31906ab0a56ff5c3_cobalt-strike_icedid_njrat_satacom_stealc

.exe 741KB

2026-07-31_df35b9700fd3822d31906ab0a56ff5c3_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 3c1bfd048758e0216fcdc515b2ed9b9d
SHA256 9af40d6baf82443f7c905e3ef878dbc5978ee3578e94b7b20d5a82ecf3e103b8
MD5 df35b9700fd3822d31906ab0a56ff5c3
SHA1 2d6001f7b56e656b0627a3e772f41a82e47b7f63
SHA512 6a070d56901bb4230ffa102b0162ee741dd1da9da80baa9a9fff3612d0a45e17ad9fba1cc04934c715f52c7aa9c04534515a0fe4566b5fb30aa9117fc776c77b
SSDEEP 12288:yo9YOFx87kSFyZSkq9L5g9yCZ+rDYClURMku:z9YOFkkeyZST9L5g9y1VU
TLSH
T18FF49E29EBE902F8D1B7C675CE664516EBB278494370A6DF03D04A562F337D08A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

356736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

avicap32

capCreateCaptureWindowW

secur32

AcquireCredentialsHandleW DecryptMessage DeleteSecurityContext EncryptMessage FreeCredentialsHandle InitializeSecurityContextA FreeContextBuffer QueryContextAttributesA

iphlpapi

GetAdaptersInfo

gdi32

SetBkMode SetTextColor DeleteDC CreateFontW CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt DeleteObject CreateSolidBrush

user32

ShowCursor SystemParametersInfoW KillTimer PostThreadMessageW DrawTextW GetClientRect SetWindowLongW SetClipboardData SetWindowsHookExW BeginPaint LoadCursorW EnumDisplayDevicesW FindWindowW GetClipboardData SetCursorPos SetFocus UnhookWindowsHookEx GetTopWindow BlockInput MapVirtualKeyA LockWorkStation PeekMessageW EnumDisplaySettingsExW EmptyClipboard CloseClipboard SetTimer DispatchMessageW OpenClipboard EndPaint GetWindowTextW TranslateMessage ReleaseDC ClipCursor IsWindow GetWindowThreadProcessId GetMessageW DefWindowProcW PostMessageW GetWindow DestroyWindow GetDC IsWindowVisible SetWindowPos keybd_event FillRect CreateWindowExW SendMessageW CallNextHookEx GetSystemMetrics MessageBeep RegisterClassExW VkKeyScanA ShowWindow

shell32

ShellExecuteExW SHGetFolderPathW ShellExecuteW

ws2_32

select closesocket shutdown setsockopt freeaddrinfo recv connect socket send WSAStartup getaddrinfo

ole32

CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance CoUninitialize GetHGlobalFromStream CoInitializeEx

gdiplus

GdipCreateBitmapFromScan0 GdipGetImageEncodersSize GdipBitmapLockBits GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipBitmapUnlockBits GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdiplusStartup GdipSaveImageToFile GdipSaveImageToStream

winmm

waveInClose waveInStop waveInPrepareHeader waveOutSetVolume waveInUnprepareHeader waveInOpen waveInStart waveInAddBuffer

advapi32

RegEnumKeyExW SystemFunction036 LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegCreateKeyExW RegQueryValueExW RegDeleteTreeW RegSetValueExW OpenProcessToken RegOpenKeyExW RegDeleteValueW

kernel32

ReadFile HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW GetConsoleMode GetConsoleOutputCP FlushFileBuffers CreatePipe GetExitCodeProcess HeapFree HeapAlloc SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA WriteConsoleW GetFileType GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread DuplicateHandle IsProcessorFeaturePresent FlsFree FlsSetValue GetACP FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException OutputDebugStringW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetStringTypeW WakeAllConditionVariable GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LCMapStringEx GetExitCodeThread WaitForSingleObjectEx AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindFirstFileExW QueryPerformanceFrequency QueryPerformanceCounter GetLocaleInfoEx FormatMessageA LocalFree ReadConsoleW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize SetEndOfFile RtlPcToFileHeader FlsGetValue CreateDirectoryW SizeofResource CompareFileTime FindFirstFileW FindNextFileW GetCurrentProcess WriteFile TerminateProcess GetModuleFileNameW GetEnvironmentVariableW GetSystemPowerStatus GetTempPathW CreateMutexW FindClose WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId GetVersionExW GetSystemDirectoryW OpenProcess SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetLastError Process32NextW GlobalSize GetDiskFreeSpaceExW LockResource GlobalAlloc DeleteFileW Process32FirstW CloseHandle GetSystemInfo LoadResource FindResourceW GetLocalTime Beep GetProcAddress GlobalLock ExitProcess ReadProcessMemory GetComputerNameW GetCurrentProcessId GlobalMemoryStatusEx CreateProcessW GetModuleHandleW CopyFileW WideCharToMultiByte GetTempFileNameW GetTickCount GlobalUnlock GetFileTime IsDebuggerPresent VirtualQueryEx InitializeCriticalSection EnterCriticalSection LeaveCriticalSection VirtualProtect RtlUnwind

Name

.text

Size

544KB

Virtual Size

543KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_df35b9700fd3822d31906ab0a56ff5c3_cobalt-strike_icedid_njrat_satacom_stealc

avicap32

secur32

iphlpapi

gdi32

user32

shell32

ws2_32

ole32

gdiplus

winmm

advapi32

kernel32

generic