2026-08-01_f5e0c48a856348d08df464764f9c70fb_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_f5e0c48a856348d08df464764f9c70fb_cobalt-strike_icedid_njrat_satacom_stealc
Size 815KB
Sample260801-cv1dbacb93
SHA256 6b6249ed01704138c060d785110a650121b003c83b240bd43e02d37db441b84c
MD5 f5e0c48a856348d08df464764f9c70fb
SHA1 79b5de3f8fb906da843c4b8569a61d8e1a9b5113
SHA512 2f8aeb3d38edfd3f165fe86381f42154c877f741a87e8b9e88c779bf4802431c405e6609eaaf690a417930ff7887a99a8dc9b76fd1fa0711954a14af391b624c
SSDEEP 12288:+ZGWOIehwmZ2/XM14Tjs+Bchv8fy8iKQpsz/v+JWnBo44E:PmwTZ2fbIkfyQQpsz+WnBT
TLSH
T17E059E59F2E800EEE077E538D5616A17E93278560F30AADF13D005697F336E44A7BB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_f5e0c48a856348d08df464764f9c70fb_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-01_f5e0c48a856348d08df464764f9c70fb_cobalt-strike_icedid_njrat_satacom_stealc

.exe 815KB

2026-08-01_f5e0c48a856348d08df464764f9c70fb_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 9cc5bbb855cd7ab4e2509f4f2a04aa0d
SHA256 6b6249ed01704138c060d785110a650121b003c83b240bd43e02d37db441b84c
MD5 f5e0c48a856348d08df464764f9c70fb
SHA1 79b5de3f8fb906da843c4b8569a61d8e1a9b5113
SHA512 2f8aeb3d38edfd3f165fe86381f42154c877f741a87e8b9e88c779bf4802431c405e6609eaaf690a417930ff7887a99a8dc9b76fd1fa0711954a14af391b624c
SSDEEP 12288:+ZGWOIehwmZ2/XM14Tjs+Bchv8fy8iKQpsz/v+JWnBo44E:PmwTZ2fbIkfyQQpsz+WnBT
TLSH
T17E059E59F2E800EEE077E538D5616A17E93278560F30AADF13D005697F336E44A7BB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

430800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpOpenRequest WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpSendRequest WinHttpOpen WinHttpReceiveResponse WinHttpQueryHeaders

crypt32

CryptStringToBinaryA

user32

PostMessageW DefWindowProcW DispatchMessageW SendMessageW PeekMessageW GetClipboardData PostQuitMessage ScreenToClient ClientToScreen SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard RegisterClassExW SetClipboardData CloseClipboard OpenClipboard CreateIconFromResourceEx LoadCursorA GetCursorPos GetWindowRect UpdateWindow GetSystemMetrics SetWindowPos ShowWindow CreateWindowExW TranslateMessage

advapi32

CryptSetKeyParam RegCloseKey RegCreateKeyExW AllocateAndInitializeSid RegDeleteValueW RegOpenKeyExW CheckTokenMembership RegQueryValueExW CryptDestroyHash RegSetValueExW CryptAcquireContextA CryptHashData CryptCreateHash CryptDecrypt CryptImportKey CryptGenRandom CryptGetHashParam CryptAcquireContextW CryptDestroyKey CryptReleaseContext FreeSid

shell32

CommandLineToArgvW ShellExecuteW

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

iphlpapi

GetAdaptersInfo

kernel32

HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent ReadFile WriteConsoleW GetModuleHandleExW GetFileType GetStdHandle DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer VirtualProtect LoadLibraryExW CompareStringW LCMapStringW HeapAlloc GetConsoleOutputCP GetConsoleMode ReadConsoleW SetFilePointerEx GetFileSizeEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW FlsFree GetProcessHeap FlsGetValue FlsAlloc SetLastError SetStdHandle GetStringTypeW OutputDebugStringW GetCommandLineW CreateDirectoryW CreateFileA CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetVolumeInformationW WriteFile GetTempPathW GetTempPathA IsDebuggerPresent CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcess ExitProcess TerminateProcess CreateThread CreateRemoteThread GetCurrentThread ResumeThread GetThreadContext SetThreadContext GetSystemTimeAsFileTime GetSystemDirectoryW VirtualAllocEx ReadProcessMemory WriteProcessMemory VirtualFreeEx GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryA LocalFree CopyFileW GetComputerNameW MultiByteToWideChar WideCharToMultiByte GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetLocaleInfoA ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId InitializeSListHead HeapSize HeapReAlloc SetEndOfFile FlsSetValue CreateProcessW RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

588KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

182KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_f5e0c48a856348d08df464764f9c70fb_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

crypt32

user32

advapi32

shell32

d3d11

d3dcompiler_47

iphlpapi

kernel32

imm32

generic