2026-08-03_46dee61e52b3d1d329e1ae6452481b25_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_46dee61e52b3d1d329e1ae6452481b25_cobalt-strike_icedid_njrat_satacom_stealc
Size 3.0MB
Sample260803-k949tavycs
SHA256 cbef3df39f13ceec5bb59a46896a77a7dc9f4442ffbe4321f93eae7299c8a8bd
MD5 46dee61e52b3d1d329e1ae6452481b25
SHA1 954510f3d07ea60aa348992b5babcac705a936d1
SHA512 a5cd09f8b92bc2422802c9698196599c4d724a1cdb0dc9973a50cc36c5760877dcc1fb4402016c109743b144b90c0e7875d1a10cae9463c88e05e06b8605cdc3
SSDEEP 49152:q3rzIKcB09yHpwM6XInAoG0yus0A+nUA9E7dg2SpfrQ37:2zc+usrSlQ37
TLSH
T1ABE5AE53F35552D5E831653899A2E327B3367424172282CB63B835282FE77E01EB7BC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_46dee61e52b3d1d329e1ae6452481b25_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-03_46dee61e52b3d1d329e1ae6452481b25_cobalt-strike_icedid_njrat_satacom_stealc

.exe 3.0MB

2026-08-03_46dee61e52b3d1d329e1ae6452481b25_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH eb1a6d0035329765f85bf496393c3445
SHA256 cbef3df39f13ceec5bb59a46896a77a7dc9f4442ffbe4321f93eae7299c8a8bd
MD5 46dee61e52b3d1d329e1ae6452481b25
SHA1 954510f3d07ea60aa348992b5babcac705a936d1
SHA512 a5cd09f8b92bc2422802c9698196599c4d724a1cdb0dc9973a50cc36c5760877dcc1fb4402016c109743b144b90c0e7875d1a10cae9463c88e05e06b8605cdc3
SSDEEP 49152:q3rzIKcB09yHpwM6XInAoG0yus0A+nUA9E7dg2SpfrQ37:2zc+usrSlQ37
TLSH
T1ABE5AE53F35552D5E831653899A2E327B3367424172282CB63B835282FE77E01EB7BC6
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1000512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\boss\source\repos\NokchiSolutions\bin\x64\Release\NokchiCore.pdb

d3d11

D3D11CreateDeviceAndSwapChain D3D11CreateDevice

user32

SetProcessDpiAwarenessContext GetDpiForSystem PeekMessageW GetMonitorInfoW MonitorFromPoint SetThreadDpiAwarenessContext GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData TranslateMessage GetDpiForWindow LoadCursorW LoadIconW RegisterClassExW CreateWindowExW UnregisterClassW ShowWindow SetWindowPos UpdateWindow SetForegroundWindow SetClipboardData DispatchMessageW GetWindowLongPtrW SetWindowLongPtrW DefWindowProcW PostQuitMessage DestroyWindow

kernel32

FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage GetFileSizeEx GetConsoleOutputCP GetTimeZoneInformation ReadConsoleW SetFilePointerEx EnumSystemLocalesW OutputDebugStringW GetSystemWindowsDirectoryW CompareStringOrdinal GetLastError FindResourceW SizeofResource Sleep FindNextFileW GetCurrentProcess EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetConsoleMode FlsGetValue GetCurrentThreadId FlsSetValue FlsFree FlsAlloc SetEnvironmentVariableW GetCommandLineA GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW VirtualProtect IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetProcessHeap HeapSize LoadLibraryExW HeapReAlloc UnhandledExceptionFilter RtlCaptureContext HeapAlloc HeapFree TerminateProcess ExitProcess GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread ReadFile GetFileType SetStdHandle SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime GetCPInfo WriteConsoleW SetEndOfFile GetUserDefaultLCID OutputDebugStringA GetStringTypeW DecodePointer EncodePointer InitializeCriticalSectionEx AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLocalTime GetCurrentProcessId WriteFile CreateFileW FlushFileBuffers CloseHandle WideCharToMultiByte VirtualQuery GetModuleFileNameW GetModuleFileNameA RtlLookupFunctionEntry RtlVirtualUnwind SetThreadStackGuarantee SetUnhandledExceptionFilter IsDebuggerPresent CheckRemoteDebuggerPresent GetModuleHandleW TlsAlloc GetProcAddress TlsFree TlsGetValue TlsSetValue MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadResource LockResource GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte FreeLibrary QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW WaitForSingleObjectEx GetExitCodeThread

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress

d3dcompiler_47

D3DCompile

dwmapi

DwmSetWindowAttribute

shell32

SHCreateDirectoryExW ShellExecuteW SHGetKnownFolderPath

ole32

CoTaskMemFree

wintrust

WinVerifyTrust

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

896KB

Virtual Size

895KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

872KB

Virtual Size

872KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_46dee61e52b3d1d329e1ae6452481b25_cobalt-strike_icedid_njrat_satacom_stealc

d3d11

user32

kernel32

imm32

api-ms-win-core-synch-l1-2-0

d3dcompiler_47

dwmapi

shell32

ole32

wintrust

generic