2026-08-02_8e89778538b22f685fc86340948184a4_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_8e89778538b22f685fc86340948184a4_cobalt-strike_icedid_njrat_satacom_stealc
Size 4.8MB
Sample260802-ddd97a11ds
SHA256 5a6494d5c5a69c4d0d637f8ec03e3f90b483953c62541b6bc03ff70d873e9a4e
MD5 8e89778538b22f685fc86340948184a4
SHA1 c65d4fc195d41d321b806f5da55f59625f57305e
SHA512 65a5c4184a97781778a8679360a1fd3c74e0d836e31ade80ba73c42756391fd9e174e554543720cd36042ca52389fd30a1aa3555d4a6dfbc14a3a3bd5b0d6efe
SSDEEP 98304:h9pP6bK+NmgmGDBr+UkpgovXdSR0/B16q0sOk:tX+N/ydz5/ik
TLSH
T13236F155B1B500FDE137E07895D6661BFB723C580730AAEB13E00A5A2F637E09A7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_8e89778538b22f685fc86340948184a4_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-02_8e89778538b22f685fc86340948184a4_cobalt-strike_icedid_njrat_satacom_stealc

.exe 4.8MB

2026-08-02_8e89778538b22f685fc86340948184a4_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 58fae62c2b53e22e7676495ceb8b2e09
SHA256 5a6494d5c5a69c4d0d637f8ec03e3f90b483953c62541b6bc03ff70d873e9a4e
MD5 8e89778538b22f685fc86340948184a4
SHA1 c65d4fc195d41d321b806f5da55f59625f57305e
SHA512 65a5c4184a97781778a8679360a1fd3c74e0d836e31ade80ba73c42756391fd9e174e554543720cd36042ca52389fd30a1aa3555d4a6dfbc14a3a3bd5b0d6efe
SSDEEP 98304:h9pP6bK+NmgmGDBr+UkpgovXdSR0/B16q0sOk:tX+N/ydz5/ik
TLSH
T13236F155B1B500FDE137E07895D6661BFB723C580730AAEB13E00A5A2F637E09A7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

876848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\barle\Downloads\veil external (5)\veil external\Base\x64\Release\Chrome.pdb

kernel32

CopyFileW MoveFileExW ReadDirectoryChangesW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetEnvironmentVariableA CreateDirectoryA DeleteFileA FindClose FindFirstFileA FindNextFileA VirtualAllocEx VirtualProtectEx ReadProcessMemory WriteProcessMemory VirtualFreeEx FlushInstructionCache VirtualQueryEx GetModuleHandleA CreateFileA GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThread SetThreadPriority GetEnvironmentVariableW ExitProcess GetModuleFileNameA GetModuleFileNameW K32GetModuleBaseNameA VerSetConditionMask FreeLibrary GetProcAddress LoadLibraryA GetLocaleInfoA GetCommandLineW GetCurrentProcess GetCurrentProcessId OpenProcess CreateThread GetStartupInfoW Process32Next Module32Next GetFileAttributesA CreateRemoteThread GetExitCodeThread GetModuleHandleW GetModuleHandleExW LoadResource LockResource SizeofResource FindResourceA Module32FirstW Module32NextW K32EnumProcessModulesEx K32GetModuleBaseNameW SearchPathW FindFirstFileW FindNextFileW GetFileAttributesExW RemoveDirectoryW WriteConsoleW SetEndOfFile HeapSize SetStdHandle GetProcessHeap GetTickCount FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindFirstFileExW HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepConditionVariableSRW WakeAllConditionVariable RtlUnwind AcquireSRWLockExclusive GetLocalTime CreateProcessW GetExitCodeProcess TerminateProcess WaitForMultipleObjects Sleep CreateEventW WaitForSingleObject ResetEvent SetEvent CancelIoEx GetOverlappedResult PeekNamedPipe CreatePipe GetLastError SetHandleInformation CloseHandle GetTempPathW WriteFile SetFileTime ReadFile GetFileTime GetFileSizeEx ReleaseSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetFileAttributesW DeleteFileW GetTickCount64 CreateFileW CreateDirectoryW ExpandEnvironmentStringsW

user32

TranslateMessage DispatchMessageA PeekMessageA DefWindowProcA UnregisterClassA RegisterClassExA CreateWindowExA DestroyWindow ShowWindow UpdateWindow GetDC ReleaseDC DrawIconEx GetIconInfo GetMonitorInfoA EnumDisplayMonitors GetCursorInfo mouse_event IsWindowVisible keybd_event MapVirtualKeyW GetWindowTextW EnumWindows GetClassNameW IsWindow OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo GetKeyState GetCapture SetCapture GetAsyncKeyState SendMessageW ReleaseCapture IsWindowUnicode GetForegroundWindow GetClientRect SetCursorPos SetCursor GetCursorPos ClientToScreen ScreenToClient LoadCursorA MonitorFromWindow SetProcessDPIAware GetMessageA PostMessageA SetWindowDisplayAffinity GetWindowThreadProcessId SetWindowLongA PostMessageW GetAncestor CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetWindow GetTopWindow FindWindowA SetWindowLongPtrW MessageBoxA GetWindowLongA GetWindowRect GetSystemMetrics SetWindowPos SetLayeredWindowAttributes CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PostThreadMessageW

gdi32

GetStockObject StretchDIBits DeleteObject

comdlg32

GetOpenFileNameW

advapi32

OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW CreateProcessAsUserW SetThreadToken AdjustTokenPrivileges LookupPrivilegeValueA LookupPrivilegeValueW SetTokenInformation RevertToSelf PrivilegeCheck GetTokenInformation DuplicateTokenEx

shell32

SHCreateDirectoryExW ShellExecuteA

ole32

PropVariantClear CoTaskMemFree CreateStreamOnHGlobal CoInitializeEx CoUninitialize CoCreateInstance

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpen

d3d11

D3D11CreateDevice D3D11CreateDeviceAndSwapChain

wininet

HttpOpenRequestA InternetReadFile InternetConnectA InternetCloseHandle InternetOpenA HttpSendRequestA

gdiplus

GdipDisposeImage GdipCloneImage GdiplusShutdown GdipCreateBitmapFromStream GdipFree GdipAlloc GdipBitmapLockBits GdipBitmapUnlockBits GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromFile GdipCreateBitmapFromFileICM GdipGetImageHeight GdipGetImageWidth GdiplusStartup

winmm

timeEndPeriod timeBeginPeriod

shlwapi

ord12

imm32

ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

560KB

Virtual Size

560KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_8e89778538b22f685fc86340948184a4_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

winhttp

d3d11

wininet

gdiplus

winmm

shlwapi

imm32

d3dcompiler_47

dwmapi

generic