2026-08-03_2113de2ffb9bdfc5abb130033733840d_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_2113de2ffb9bdfc5abb130033733840d_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.4MB
Sample260803-dd9q4abc39
SHA256 19627c202abe62255cf2dc5fb58d173c6a866e6c91a5658a6c91c922cb468a91
MD5 2113de2ffb9bdfc5abb130033733840d
SHA1 7bb52792eb20a8f2bc7b59e4635969a61223a4f8
SHA512 e35f44275134578cebd768c21692282ad443696a5ade82924c5ec190d690b7e5409d3dd8e717fa6c7b0bf3073c75432c21dea3d45f6d54f1ed293e7357b374c5
SSDEEP 24576:GQlukUUFP90ySMKZugODjjqVW8GK3niOd/gh:9FfFPi1Zu326K3
TLSH
T1D6658E07E2B901ECD467C2B8CA165B07EB72B4451334AEDF539089662F23EE15B7B760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_2113de2ffb9bdfc5abb130033733840d_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-03_2113de2ffb9bdfc5abb130033733840d_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.4MB

2026-08-03_2113de2ffb9bdfc5abb130033733840d_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 7d0acfdcb11aaf5c5a41586183adbb92
SHA256 19627c202abe62255cf2dc5fb58d173c6a866e6c91a5658a6c91c922cb468a91
MD5 2113de2ffb9bdfc5abb130033733840d
SHA1 7bb52792eb20a8f2bc7b59e4635969a61223a4f8
SHA512 e35f44275134578cebd768c21692282ad443696a5ade82924c5ec190d690b7e5409d3dd8e717fa6c7b0bf3073c75432c21dea3d45f6d54f1ed293e7357b374c5
SSDEEP 24576:GQlukUUFP90ySMKZugODjjqVW8GK3niOd/gh:9FfFPi1Zu326K3
TLSH
T1D6658E07E2B901ECD467C2B8CA165B07EB72B4451334AEDF539089662F23EE15B7B760
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1065280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetOpenUrlA HttpQueryInfoA InternetQueryOptionA InternetReadFile InternetGetConnectedState HttpSendRequestA HttpOpenRequestA InternetSetOptionA InternetConnectA InternetCloseHandle InternetOpenA

crypt32

CryptUnprotectData

bcrypt

BCryptDecrypt BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey

iphlpapi

GetAdaptersInfo

shell32

ShellExecuteA ExtractIconExW SHCreateDirectoryExW SHGetFolderPathW ord680 ShellExecuteExW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegSetValueExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW AllocateAndInitializeSid CheckTokenMembership FreeSid GetUserNameA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegOpenKeyExA RegCloseKey

user32

CloseClipboard OpenClipboard CallNextHookEx LoadIconW DestroyIcon ExitWindowsEx PostMessageW UnhookWindowsHookEx SetWindowsHookExW MessageBoxA GetForegroundWindow GetKeyboardState PostThreadMessageW PeekMessageW DispatchMessageW TranslateMessage GetKeyboardLayout ToUnicodeEx ReleaseDC GetDC GetSystemMetrics GetClipboardData SystemParametersInfoW LockWorkStation GetWindowTextA

gdi32

CreateCompatibleDC DeleteDC DeleteObject SelectObject CreateDIBSection GdiFlush BitBlt

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

kernel32

GetStartupInfoW InitializeSListHead SetUnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetConsoleOutputCP GetConsoleMode WriteConsoleW GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW SetLastError FlsAlloc FlsGetValue GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage FlsSetValue FlsFree IsProcessorFeaturePresent FreeLibrary GetModuleHandleExW UnhandledExceptionFilter GetFileType LocalFree GetCommandLineW GetCommandLineA FindFirstFileExW GetACP GetOEMCP SetFilePointerEx RaiseException SetFileAttributesW CloseHandle GetLastError CreateMutexA Sleep ExitProcess CreateThread GetModuleFileNameW LoadLibraryW CopyFileW CreateFileW IsDebuggerPresent GetCurrentProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount64 CreateFileMappingW MapViewOfFile FlushViewOfFile UnmapViewOfFile GetModuleHandleA GetProcAddress LoadLibraryA CreateToolhelp32Snapshot Process32FirstW Process32NextW DeleteFileW GetFileAttributesW WriteFile WaitForSingleObject GetDiskFreeSpaceExA GetLogicalDrives OpenProcess GlobalUnlock GlobalLock GetComputerNameA GetStdHandle ReadFile SetHandleInformation CreatePipe CreateProcessA FindClose FindFirstFileW FindNextFileW AreFileApisANSI GetDriveTypeA TerminateProcess GetLogicalDriveStringsA K32GetProcessMemoryInfo GetFileSize GetTempPathW MultiByteToWideChar WideCharToMultiByte GetSystemDirectoryW VirtualProtect GetModuleHandleW CreateFileA GetTempPathA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlushFileBuffers GetTickCount QueryPerformanceCounter FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetProcessHeap GetCurrentProcessId LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc HeapReAlloc DeleteFileA WaitForSingleObjectEx OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW HeapSize HeapValidate CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate GetTimeZoneInformation

winmm

waveInOpen waveInClose waveInPrepareHeader waveInUnprepareHeader waveInAddBuffer waveInStart waveInReset waveInStop

comctl32

InitCommonControlsEx ord345

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader RtlVirtualUnwind

Name

gvtbvaqc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

dcweboqd

Size

213KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

hqxkvthi

Size

19KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

vnwewfqf

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

ifngqild

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ttwjwxju

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

nicfsgzy

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_2113de2ffb9bdfc5abb130033733840d_cobalt-strike_icedid_njrat_satacom_stealc

wininet

crypt32

bcrypt

iphlpapi

shell32

advapi32

user32

gdi32

ole32

oleaut32

kernel32

winmm

comctl32

ntdll

generic