2026-08-03_084962475e5e9c16b3a84c2002a20c59_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_084962475e5e9c16b3a84c2002a20c59_cobalt-strike_icedid_njrat_satacom_stealc
Size 4.7MB
Sample260803-dhvsqsbl6t
SHA256 61829555ff66bea99821dd3764b10fcee704c1441ab6462f8dd100a0716e4d9b
MD5 084962475e5e9c16b3a84c2002a20c59
SHA1 8e8684956307ee50ebfd6dd1c803478518163f1d
SHA512 5a361c4803b017e8a70d3eb4d8fc1f23c0bddb7014dff2bfe3ea8018f135f398871a93ca33fa89d86eadf7ae3aa13e162a0e56d01c814f47242de06679d58360
SSDEEP 98304:LwOsWUw2AbPuKki0gw01bVKS2pg+ER5samu/g/dgZ:L7P/5Cg0d0FV72BEReam3
TLSH
T1E736237EA77608F5C5224135C8969283D5E2D82AEB57C2C397721D8E0E63BD2F839770
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_084962475e5e9c16b3a84c2002a20c59_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-03_084962475e5e9c16b3a84c2002a20c59_cobalt-strike_icedid_njrat_satacom_stealc

.exe 4.7MB

2026-08-03_084962475e5e9c16b3a84c2002a20c59_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH d2c40d2d11dc2d19266c62ec9c223d03
SHA256 61829555ff66bea99821dd3764b10fcee704c1441ab6462f8dd100a0716e4d9b
MD5 084962475e5e9c16b3a84c2002a20c59
SHA1 8e8684956307ee50ebfd6dd1c803478518163f1d
SHA512 5a361c4803b017e8a70d3eb4d8fc1f23c0bddb7014dff2bfe3ea8018f135f398871a93ca33fa89d86eadf7ae3aa13e162a0e56d01c814f47242de06679d58360
SSDEEP 98304:LwOsWUw2AbPuKki0gw01bVKS2pg+ER5samu/g/dgZ:L7P/5Cg0d0FV72BEReam3
TLSH
T1E736237EA77608F5C5224135C8969283D5E2D82AEB57C2C397721D8E0E63BD2F839770
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetConsoleCursorInfo SetConsoleWindowInfo GetTempPathW GetFileAttributesW CreateToolhelp32Snapshot GetConsoleMode GetLastError SetConsoleCursorInfo Process32NextW DeleteFileW Process32FirstW SetConsoleMode SetConsoleCP CreateProcessW GetConsoleWindow SetConsoleOutputCP SetConsoleCursorPosition SetConsoleTitleW SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetStdHandle SetConsoleScreenBufferSize CloseHandle GetConsoleScreenBufferInfo GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetConsoleCP IsProcessorFeaturePresent GetModuleFileNameW WriteFile GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP HeapFree HeapAlloc CreateFileW GetNumberOfConsoleInputEvents ReadConsoleInputW PeekConsoleInputA ReadConsoleW WaitForSingleObject GetExitCodeProcess GetFileAttributesExW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile IsValidCodePage GetACP GetOEMCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW RtlUnwind

user32

SetWindowLongW GetWindowLongW SetWindowPos

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

ShellExecuteW ShellExecuteExW

Name

.text

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ot

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.at

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_084962475e5e9c16b3a84c2002a20c59_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

generic