2026-08-03_d87002ff04bf4bb84336948add3bedd1_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_d87002ff04bf4bb84336948add3bedd1_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.3MB
Sample260803-m2a24shj21
SHA256 b2477fbee1a359069f59ebf1357d8f84c9fef74069a5553b3e223438e5ca1a49
MD5 d87002ff04bf4bb84336948add3bedd1
SHA1 ca6abd1175b9b05e56445d7b91b8c58ec4060bc1
SHA512 9591b047c76350791a036d1a03426650a64db31c274b984c22e69e8b3a66a818563e4b7e6bc21dfe4323ba723348f515acaa93f995aaaf4960113c7c073a0511
SSDEEP 24576:muYVy+rJjU/+IWc9AhyaLrJ7RM2DYPdAMG+0r5g5KZiAynK:wy+rFUWpq2yoRM3PdsR0lnK
TLSH
T10855AF41E3B801E8C26F8278C6469A0BEB72780513205BDB57E45B6A3F63BE15F7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_d87002ff04bf4bb84336948add3bedd1_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-03_d87002ff04bf4bb84336948add3bedd1_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.3MB

2026-08-03_d87002ff04bf4bb84336948add3bedd1_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 668de89832765dc5e36825c60cade7df
SHA256 b2477fbee1a359069f59ebf1357d8f84c9fef74069a5553b3e223438e5ca1a49
MD5 d87002ff04bf4bb84336948add3bedd1
SHA1 ca6abd1175b9b05e56445d7b91b8c58ec4060bc1
SHA512 9591b047c76350791a036d1a03426650a64db31c274b984c22e69e8b3a66a818563e4b7e6bc21dfe4323ba723348f515acaa93f995aaaf4960113c7c073a0511
SSDEEP 24576:muYVy+rJjU/+IWc9AhyaLrJ7RM2DYPdAMG+0r5g5KZiAynK:wy+rFUWpq2yoRM3PdsR0lnK
TLSH
T10855AF41E3B801E8C26F8278C6469A0BEB72780513205BDB57E45B6A3F63BE15F7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

745248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

kernel32

Sleep GetLastError Process32Next CloseHandle GetProcAddress CreateFileMappingA GetSystemTimeAsFileTime FormatMessageA MapViewOfFile GetProcessTimes MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileType EnumSystemLocalesW SetEnvironmentVariableW IsValidLocale CreateToolhelp32Snapshot LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA ExitProcess GetCurrentProcess GetModuleFileNameW WriteFile GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind FlsFree FlsSetValue OpenProcess GetModuleHandleA UnmapViewOfFile WaitForSingleObject SetStdHandle CreateFileW HeapSize WriteConsoleW FlsGetValue FlsAlloc SetLastError TerminateProcess Process32First GetModuleFileNameA GetLocaleInfoW FreeEnvironmentStringsW GetUserDefaultLCID CreateDirectoryW LocalFree GetLocaleInfoEx SetEndOfFile FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetModuleHandleW MoveFileExW GetFileInformationByHandleEx GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStringTypeW GetCPInfo GetCurrentProcessId InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException

user32

GetKeyState GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData LoadCursorA ScreenToClient GetSystemMetrics ShowWindow DispatchMessageA DestroyWindow MessageBoxW CreatePopupMenu TrackPopupMenu wsprintfA DefWindowProcA DestroyMenu CreateWindowExA TranslateMessage LoadIconA AppendMenuW PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA SetForegroundWindow GetCursorPos

advapi32

FreeSid AllocateAndInitializeSid CheckTokenMembership

shell32

ShellExecuteA Shell_NotifyIconW ExtractIconA

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

922KB

Virtual Size

922KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

388KB

Virtual Size

387KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_d87002ff04bf4bb84336948add3bedd1_cobalt-strike_icedid_njrat_satacom_stealc

d3d11

dwmapi

kernel32

user32

advapi32

shell32

imm32

d3dcompiler_47

generic