2026-08-01_32017513a0972e347b52389d2ce69ffc_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_32017513a0972e347b52389d2ce69ffc_cobalt-strike_icedid_njrat_satacom_stealc
Size 3.6MB
Sample260802-ew69csch84
SHA256 a5f3048a7dfde39428569c058f734a680fe2bc73b5fc402ecf576d4ad3519966
MD5 32017513a0972e347b52389d2ce69ffc
SHA1 fcf8d959c88a335619275d30db8e2e9d75bd69aa
SHA512 a34488c6c86148da72cd8c350f2e2afd8419f0ab08459a85485d6f140b3e4a417955a6cb9d1698ec08c99129e64e3130e56001a7d536f3e1e5260d4b15c6c7a5
SSDEEP 49152:pw950GwSEJs8O2DjQSBEzntn2jUoL6nI/fu0bIZ1VVkASdOX0QJdskYu:VWEXOvZMU2O6IrkeBj
TLSH
T1DF06E113F36182DDC51B9938C6A29B46F7717841272497DB32A42B19AF932F01FBB391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_32017513a0972e347b52389d2ce69ffc_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-01_32017513a0972e347b52389d2ce69ffc_cobalt-strike_icedid_njrat_satacom_stealc

.exe 3.6MB

2026-08-01_32017513a0972e347b52389d2ce69ffc_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 8eefc7c688e25871af9e548874f89160
SHA256 a5f3048a7dfde39428569c058f734a680fe2bc73b5fc402ecf576d4ad3519966
MD5 32017513a0972e347b52389d2ce69ffc
SHA1 fcf8d959c88a335619275d30db8e2e9d75bd69aa
SHA512 a34488c6c86148da72cd8c350f2e2afd8419f0ab08459a85485d6f140b3e4a417955a6cb9d1698ec08c99129e64e3130e56001a7d536f3e1e5260d4b15c6c7a5
SSDEEP 49152:pw950GwSEJs8O2DjQSBEzntn2jUoL6nI/fu0bIZ1VVkASdOX0QJdskYu:VWEXOvZMU2O6IrkeBj
TLSH
T1DF06E113F36182DDC51B9938C6A29B46F7717841272497DB32A42B19AF932F01FBB391
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

807904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\V24\Downloads\SPAROPERMSPOOFthebest (1)\SPAROPERMSPOOFthebest (1)\SPAROPERMSPOOFthebest\SPAROPERMSPOOF\x64\Release\Sparo.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

WaitForSingleObject CreateFileA CloseHandle CreateProcessA GetModuleHandleW SizeofResource SetHandleInformation GetStdHandle TerminateProcess CreatePipe PeekNamedPipe GetEnvironmentVariableA GetFileAttributesA LockResource CreateThread LoadResource FindResourceW Beep CreateProcessW CreateDirectoryA HeapSize CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetModuleFileNameW IsProcessorFeaturePresent ExitProcess GetCurrentProcess DuplicateHandle OutputDebugStringA GetModuleFileNameA ReadFile LoadLibraryW QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree RtlUnwind FlsFree FlsSetValue FlsGetValue GlobalAlloc MultiByteToWideChar WriteConsoleW GetExitCodeProcess FlsAlloc SetLastError RtlUnwindEx GetFileSizeEx HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA GetCurrentThreadId GetLastError SetEndOfFile FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW RtlPcToFileHeader RaiseException FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry

user32

EmptyClipboard SetClipboardData OpenClipboard GetCursorPos CloseClipboard GetClipboardData MessageBoxA ReleaseCapture GetWindowLongW DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW SetWindowLongA PeekMessageW SetLayeredWindowAttributes TranslateMessage LoadIconW PostQuitMessage UpdateWindow IsWindowUnicode GetWindowRect MoveWindow GetKeyState ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect SetCursorPos

advapi32

RegCloseKey RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegQueryValueExA RegEnumKeyExA CheckTokenMembership AllocateAndInitializeSid FreeSid

shell32

ShellExecuteW

ole32

CoCreateInstance CoInitializeEx CoUninitialize

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

Name

.text

Size

1002KB

Virtual Size

1001KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

294KB

Virtual Size

293KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

833KB

Virtual Size

841KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_32017513a0972e347b52389d2ce69ffc_cobalt-strike_icedid_njrat_satacom_stealc

d3d11

d3dcompiler_47

kernel32

user32

advapi32

shell32

ole32

imm32

dwmapi

generic