2026-08-03_c08e39bfd57fbf9ff32ba6e2b757033f_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_c08e39bfd57fbf9ff32ba6e2b757033f_cobalt-strike_icedid_njrat_satacom_stealc
Size 658KB
Sample260803-kt566seq91
SHA256 3e877c312c9f07bb866f7f7c68d7d59d9078267bd855847922ffac194ce76da7
MD5 c08e39bfd57fbf9ff32ba6e2b757033f
SHA1 d59a95a929655703512664ebb1fdce748d32d368
SHA512 768d9f7a9ba0881a5b29c66f05203d7ad6d1ab128b88a7ebc1f53966d61db2fb60f4c8049eb1cf69c5fbc0570de7dad92519d1ac42663b598544988177daecd2
SSDEEP 12288:SxboIpX6rauWKEGWiYo57fIBkQdudLHlez/HmG4L:UEIpX6AKEGWLo57okouZH8/HH
TLSH
T187E46C55B2E442F9D177C1BA8E474626E772780A1731ABDB13A087972F37AE44E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_c08e39bfd57fbf9ff32ba6e2b757033f_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-03_c08e39bfd57fbf9ff32ba6e2b757033f_cobalt-strike_icedid_njrat_satacom_stealc

.exe 658KB

2026-08-03_c08e39bfd57fbf9ff32ba6e2b757033f_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 46934834c8f7f588ee9b134378f8bff1
SHA256 3e877c312c9f07bb866f7f7c68d7d59d9078267bd855847922ffac194ce76da7
MD5 c08e39bfd57fbf9ff32ba6e2b757033f
SHA1 d59a95a929655703512664ebb1fdce748d32d368
SHA512 768d9f7a9ba0881a5b29c66f05203d7ad6d1ab128b88a7ebc1f53966d61db2fb60f4c8049eb1cf69c5fbc0570de7dad92519d1ac42663b598544988177daecd2
SSDEEP 12288:SxboIpX6rauWKEGWiYo57fIBkQdudLHlez/HmG4L:UEIpX6AKEGWLo57okouZH8/HH
TLSH
T187E46C55B2E442F9D177C1BA8E474626E772780A1731ABDB13A087972F37AE44E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

336752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoCreateInstance CoUninitialize CoInitialize

kernel32

Process32FirstW Process32NextW GetStdHandle GetCommandLineW LocalFree GetConsoleMode SetConsoleMode SetConsoleOutputCP GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleTitleW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetFileAttributesW MultiByteToWideChar FormatMessageW GetModuleHandleW WideCharToMultiByte Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetSystemTimeAsFileTime QueryPerformanceCounter TerminateProcess ResumeThread GetSystemInfo VirtualAllocEx VirtualFreeEx GetCurrentThread GetProcAddress CreateActCtxW WriteFile GetTempPathW CreateFileW UnmapViewOfFile GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx CreateToolhelp32Snapshot Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW GetNativeSystemInfo WaitForSingleObject DuplicateHandle ResetEvent GetTickCount DeviceIoControl Thread32Next Thread32First GetCurrentThreadId GetCurrentProcessId ReadFile CreateNamedPipeW TerminateThread GetExitCodeThread Sleep OpenProcess IsWow64Process WriteProcessMemory VirtualProtectEx GetThreadContext ReadProcessMemory CreateRemoteThread SetThreadContext VirtualQueryEx LoadLibraryW FreeLibrary SuspendThread GetThreadTimes OpenThread GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetModuleFileNameW GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx GetLastError CloseHandle RtlUnwind DecodePointer DeleteFileW SetStdHandle WriteConsoleW SetEndOfFile GetSystemWow64DirectoryW HeapSize GetOEMCP GetACP IsValidCodePage QueryPerformanceFrequency FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetFileInformationByHandleEx GetStringTypeW EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent ExitProcess GetModuleHandleExW HeapAlloc HeapFree VirtualProtect LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetFileSizeEx SetFilePointerEx ReadConsoleW ReadConsoleInputW HeapReAlloc

user32

wsprintfW

advapi32

RegCloseKey RegSetValueExW RegCreateKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyW RegEnumValueW RegOpenKeyExW OpenThreadToken RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

shell32

CommandLineToArgvW

oleaut32

SysFreeString

shlwapi

SHDeleteKeyW

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

481KB

Virtual Size

481KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

141KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_c08e39bfd57fbf9ff32ba6e2b757033f_cobalt-strike_icedid_njrat_satacom_stealc

ole32

kernel32

user32

advapi32

shell32

oleaut32

shlwapi

generic