2026-08-01_4b38fe25ed0014343b479084f9e14dcc_cobalt-strike_icedid_njrat_ryuk_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_4b38fe25ed0014343b479084f9e14dcc_cobalt-strike_icedid_njrat_ryuk_satacom
Size 1.3MB
Sample260802-a6evms1cpf
SHA256 67d825207c7cc20b79dac41021692e57238ed63ba2f3bc8fb6247b92e7c3f815
MD5 4b38fe25ed0014343b479084f9e14dcc
SHA1 273286ac3e5e8fbb76121acac6cdf717d01b05b5
SHA512 98006bf76e36f1b2927dbfa5b813e90bb77fa35b5242d2ad3e05fea47fdc9a9beaed4b54c84fe7d1f1f7f5c94675610abfc1ac1fab83ed9084ee2cf9a5008e3c
SSDEEP 24576:opWZ3cNTwn2f8KCT75QSeLJ16MdaKHLR08aQQcSOxTws/3K/EBQDqQBq:53cNUKCTt2rZgKbLSQEs/KDOQBq
TLSH
T12D55BF16E3E640E8DC75CB388A656722FA7178025F34A9DF12D0462A3F73EA05E3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_4b38fe25ed0014343b479084f9e14dcc_cobalt-strike_icedid_njrat_ryuk_satacom

File Explorer

2026-08-01_4b38fe25ed0014343b479084f9e14dcc_cobalt-strike_icedid_njrat_ryuk_satacom

.exe 1.3MB

2026-08-01_4b38fe25ed0014343b479084f9e14dcc_cobalt-strike_icedid_njrat_ryuk_satacom

IMPHASH 917934d044f9a61c690a7d271f84984d
SHA256 67d825207c7cc20b79dac41021692e57238ed63ba2f3bc8fb6247b92e7c3f815
MD5 4b38fe25ed0014343b479084f9e14dcc
SHA1 273286ac3e5e8fbb76121acac6cdf717d01b05b5
SHA512 98006bf76e36f1b2927dbfa5b813e90bb77fa35b5242d2ad3e05fea47fdc9a9beaed4b54c84fe7d1f1f7f5c94675610abfc1ac1fab83ed9084ee2cf9a5008e3c
SSDEEP 24576:opWZ3cNTwn2f8KCT75QSeLJ16MdaKHLR08aQQcSOxTws/3K/EBQDqQBq:53cNUKCTt2rZgKbLSQEs/KDOQBq
TLSH
T12D55BF16E3E640E8DC75CB388A656722FA7178025F34A9DF12D0462A3F73EA05E3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

508672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges ChangeServiceConfigA CloseServiceHandle CloseTrace ControlService ControlTraceA ConvertSecurityDescriptorToStringSecurityDescriptorA ConvertStringSecurityDescriptorToSecurityDescriptorA CreateServiceA DeleteService EnableTraceEx2 GetUserNameW InitializeSecurityDescriptor LookupPrivilegeValueA OpenProcessToken OpenSCManagerA OpenServiceA OpenTraceA ProcessTrace RegCloseKey RegCreateKeyExA RegGetKeySecurity RegOpenKeyA RegOpenKeyExA RegQueryValueExA RegSetKeySecurity RegSetValueA RegSetValueExA RegisterServiceCtrlHandlerExA SetSecurityDescriptorDacl SetServiceStatus StartServiceA StartServiceCtrlDispatcherA StartTraceA SystemFunction036

dinput8

DirectInput8Create

ws2_32

WSAGetLastError WSAPoll WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname htons inet_addr ioctlsocket listen recv recvfrom send sendto setsockopt socket

version

GetFileVersionInfoW VerQueryValueA

user32

BringWindowToTop CheckDlgButton CloseClipboard CreateDialogIndirectParamW CreateWindowExW DialogBoxIndirectParamW DialogBoxParamW DispatchMessageW EnableWindow EndDialog GetClassNameA GetClientRect GetClipboardData GetDlgItem GetDlgItemTextW GetForegroundWindow GetMessageW GetSubMenu GetSysColor GetSysColorBrush GetWindowLongPtrW GetWindowRect GetWindowTextW GetWindowThreadProcessId IsClipboardFormatAvailable IsDialogMessageW IsDlgButtonChecked LoadIconA LoadIconW LoadImageA LoadMenuIndirectW LoadStringW MapVirtualKeyExA MapWindowPoints MessageBoxTimeoutW MessageBoxW MoveWindow OpenClipboard PostMessageW PostQuitMessage ScreenToClient SendMessageW SetClassLongPtrW SetDlgItemTextW SetFocus SetForegroundWindow SetTimer SetWindowLongPtrW SetWindowTextW ShowWindow TrackPopupMenu TranslateMessage

ntdll

NtQueryInformationProcess NtQueryVirtualMemory NtReadVirtualMemory NtResumeProcess NtSuspendProcess NtTerminateProcess NtUnmapViewOfSection RtlCaptureContext RtlCaptureStackBackTrace RtlCrc64 RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind

oleaut32

SysAllocString SysFreeString

ole32

CoAllowSetForegroundWindow CoCreateInstance CoInitialize CoInitializeEx CoInitializeSecurity CoUninitialize

comctl32

InitCommonControlsEx

shell32

DragAcceptFiles DragFinish DragQueryFileA ShellExecuteA ord71 Shell_NotifyIconW

dbghelp

SymGetSymFromAddr64 SymInitialize

tdh

TdhGetEventInformation

gdi32

DeleteObject SetBkColor SetTextColor

iphlpapi

GetTcpTable2 SetTcpEntry

wininet

HttpAddRequestHeadersA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetReadFile InternetSetOptionA

kernel32

CloseHandle CompareStringW CopyFileA CreateDirectoryA CreateDirectoryExA CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreatePipe CreateProcessA CreateRemoteThread CreateThread CreateToolhelp32Snapshot CreateWaitableTimerA DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetExitCodeThread GetFileAttributesA GetFileAttributesExW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetStartupInfoA GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTimeZoneInformation GetUserDefaultUILanguage GlobalLock GlobalUnlock HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsBadWritePtr IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsWow64Process2 K32EnumProcessModulesEx K32EnumProcesses K32GetModuleFileNameExA LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree LockFile LockFileEx MapViewOfFile MapViewOfFileEx MoveFileA MoveFileExW MultiByteToWideChar OpenMutexA OpenProcess OutputDebugStringW Process32First Process32Next QueryFullProcessImageNameW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseMutex SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointer SetFilePointerEx SetLastError SetPriorityClass SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer SignalObjectAndWait Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnlockFile UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

Name

.text

Size

666KB

Virtual Size

665KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

146KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

26.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

25B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

472KB

Virtual Size

471KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_4b38fe25ed0014343b479084f9e14dcc_cobalt-strike_icedid_njrat_ryuk_satacom

advapi32

dinput8

ws2_32

version

user32

ntdll

oleaut32

ole32

comctl32

shell32

dbghelp

tdh

gdi32

iphlpapi

wininet

kernel32

generic