2026-08-01_853133a26d295a67b8f2d15489e40856_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_853133a26d295a67b8f2d15489e40856_cobalt-strike_icedid_njrat_satacom_stealc
Size 2.1MB
Sample260801-bfeydstyb1
SHA256 8f3ea8fecbf73697e5f552f610362a1df4ed76d15e75e630dd517a72722e1072
MD5 853133a26d295a67b8f2d15489e40856
SHA1 ae858e692e46d60cac5c6723ff7562b7f938d53f
SHA512 cbc4877efd4344bfb56065d7961f68cbc6d7641709a1f5820ecb909de0f76c433776d1ec68b8fb8983e181244a4e478a0aa34f41bb292d3b774c786e8b9f4621
SSDEEP 24576:yPlv0h/YRetTN32o1YWVUPULWHjLsZWOu+dLowzZbM4ANBU0nxZpoIKuxtFQQvww:yt8YRetwnPULQ962Kew01FQE3PFf
TLSH
T1F0A5021662D402F1E0BFD279C9A68A55FAB274161730A7CB03F445562F33BE19B3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_853133a26d295a67b8f2d15489e40856_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-01_853133a26d295a67b8f2d15489e40856_cobalt-strike_icedid_njrat_satacom_stealc

.exe 2.1MB

2026-08-01_853133a26d295a67b8f2d15489e40856_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH bf26d9af5c466e5685cc6f5e5052f2c9
SHA256 8f3ea8fecbf73697e5f552f610362a1df4ed76d15e75e630dd517a72722e1072
MD5 853133a26d295a67b8f2d15489e40856
SHA1 ae858e692e46d60cac5c6723ff7562b7f938d53f
SHA512 cbc4877efd4344bfb56065d7961f68cbc6d7641709a1f5820ecb909de0f76c433776d1ec68b8fb8983e181244a4e478a0aa34f41bb292d3b774c786e8b9f4621
SSDEEP 24576:yPlv0h/YRetTN32o1YWVUPULWHjLsZWOu+dLowzZbM4ANBU0nxZpoIKuxtFQQvww:yt8YRetwnPULQ962Kew01FQE3PFf
TLSH
T1F0A5021662D402F1E0BFD279C9A68A55FAB274161730A7CB03F445562F33BE19B3E722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHGetFolderPathA

comctl32

InitCommonControlsEx

user32

LoadCursorA GetWindowThreadProcessId FindWindowA FillRect MessageBoxA GetClientRect InvalidateRect EndPaint BeginPaint SetProcessDPIAware GetSystemMetrics KillTimer SetTimer DestroyWindow CreateWindowExA RegisterClassExA DefWindowProcA PeekMessageA DispatchMessageA TranslateMessage DrawTextA

gdi32

SetBkMode SelectObject DeleteObject CreateSolidBrush CreateFontA SetTextColor

kernel32

GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetConsoleCtrlHandler GetProcessHeap GetFileSizeEx CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect IsThreadAFiber GetTempPathW EnumSystemLocalesW GetUserDefaultLCID SetFilePointerEx ReadFile ReadConsoleW CreateFileW WriteConsoleW LCMapStringW InterlockedFlushSList CreateDirectoryA CreateFileA DeleteFileA SetFileTime CloseHandle GetLastError SetErrorMode WaitForSingleObject CreateMutexA Sleep GlobalMemoryStatusEx GetSystemInfo GetTickCount GetTickCount64 GetModuleFileNameA GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource LoadLibraryA FindResourceA CopyFileA SystemTimeToFileTime IsValidLocale QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx InterlockedPushEntrySList RtlUnwind SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetCurrentThread HeapAlloc OutputDebugStringW HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW GetLocaleInfoW

Name

.text

Size

456KB

Virtual Size

455KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_853133a26d295a67b8f2d15489e40856_cobalt-strike_icedid_njrat_satacom_stealc

shell32

comctl32

user32

gdi32

kernel32

generic