2026-08-02_f071ac6a2aa0eabf5802dcf878560aec_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_f071ac6a2aa0eabf5802dcf878560aec_cobalt-strike_icedid_njrat_satacom_stealc
Size 619KB
Sample260802-tpgsfssvb1
SHA256 9cd5d8c2cd4c82d7bdedba272c6f845ad41f0e0ab4405cd88e5e6b04e24861d7
MD5 f071ac6a2aa0eabf5802dcf878560aec
SHA1 ab094b14d3441cedd01cb52a146cd95dab7a62ad
SHA512 068c692f79dd96c63e52628265ea8cb6fbe6010099bd6fad8b594c276315c80008fbcdadcba55674e954f33f700d943bf06751333cefc42f7795d4ab4ff55b68
SSDEEP 12288:D7fW6K5ZXRuhUfYsK0bLNLsdJC+Gzo+MCvWzXtEV9vrvD:6XJAU/5WJCpztbvWzXivrv
TLSH
T194D46D26A79801FCE177C1B98A564913F772B8470371AEDF03905AA21F1B6E85F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_f071ac6a2aa0eabf5802dcf878560aec_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-02_f071ac6a2aa0eabf5802dcf878560aec_cobalt-strike_icedid_njrat_satacom_stealc

.exe 619KB

2026-08-02_f071ac6a2aa0eabf5802dcf878560aec_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 3ed18d5bf14589badf6cef20e6a83f15
SHA256 9cd5d8c2cd4c82d7bdedba272c6f845ad41f0e0ab4405cd88e5e6b04e24861d7
MD5 f071ac6a2aa0eabf5802dcf878560aec
SHA1 ab094b14d3441cedd01cb52a146cd95dab7a62ad
SHA512 068c692f79dd96c63e52628265ea8cb6fbe6010099bd6fad8b594c276315c80008fbcdadcba55674e954f33f700d943bf06751333cefc42f7795d4ab4ff55b68
SSDEEP 12288:D7fW6K5ZXRuhUfYsK0bLNLsdJC+Gzo+MCvWzXtEV9vrvD:6XJAU/5WJCpztbvWzXivrv
TLSH
T194D46D26A79801FCE177C1B98A564913F772B8470371AEDF03905AA21F1B6E85F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

281024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpOpen WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpSetTimeouts

ws2_32

accept bind closesocket connect htonl htons send setsockopt socket WSAStartup WSAGetLastError inet_pton recv listen

secur32

AcquireCredentialsHandleW FreeCredentialsHandle InitializeSecurityContextW DecryptMessage EncryptMessage FreeContextBuffer QueryContextAttributesW DeleteSecurityContext AcceptSecurityContext

bcrypt

BCryptGetProperty BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom BCryptEncrypt BCryptOpenAlgorithmProvider

crypt32

PFXExportCertStore PFXImportCertStore CryptBinaryToStringA CryptStringToBinaryA CertCreateSelfSignCertificate CertStrToNameA CryptImportPublicKeyInfoEx2 CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CryptDecodeObjectEx

advapi32

CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegQueryValueExW RegOpenKeyExW RegCloseKey

user32

GetSystemMetrics

kernel32

IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread FlsFree FlsSetValue FlsGetValue GetACP GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetOEMCP FindFirstFileExW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile ExitProcess IsProcessorFeaturePresent GetCommandLineA GetCommandLineW HeapAlloc HeapFree HeapReAlloc IsDebuggerPresent UnhandledExceptionFilter FlsAlloc SetConsoleCursorPosition SetLastError RaiseException GetStdHandle CreateFileA CreateFileW FindClose FindFirstFileW FindNextFileW GetVolumeInformationW ReadFile WriteFile OutputDebugStringA CloseHandle GetLastError ConnectNamedPipe CreateNamedPipeW DeviceIoControl Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess GetSystemInfo GetSystemTime GetSystemDirectoryW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetProcAddress LocalFree GetComputerNameW SetConsoleCtrlHandler FillConsoleOutputCharacterA FillConsoleOutputAttribute GetConsoleScreenBufferInfo SetConsoleScreenBufferSize SetConsoleTextAttribute SetConsoleWindowInfo SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer CompareStringEx MultiByteToWideChar GetCPInfo LCMapStringEx GetStringTypeW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetFileType GetFileAttributesExW CreateProcessW WaitForSingleObject GetTimeZoneInformation

ntdll

RtlLookupFunctionEntry RtlUnwindEx RtlCaptureContext RtlVirtualUnwind RtlPcToFileHeader RtlUnwind

Name

.text

Size

459KB

Virtual Size

459KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

126KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_f071ac6a2aa0eabf5802dcf878560aec_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

ws2_32

secur32

bcrypt

crypt32

advapi32

user32

kernel32

ntdll

generic