2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc
Size 946KB
Sample260803-vcdeyawsbt
SHA256 0a460a14cb9a6724d8e88b6bf7b256f436620c2d4ae2e0a6fad3416cb3bcbe13
MD5 d264738640f8c1592710c9e3a08c79cc
SHA1 62050e51300e8843da645b963321669c626e2aea
SHA512 e306aee3346d3f684c5fc84b99ff94300fd5dc588a0904eb8ae4044c16e9fd4e2d7ff345ad8d1c003ea0acf183a05b846ea3cfd06f9cf20e323abdbf7d776d97
SSDEEP 12288:SUSBkC2q9qO1xfUx+irmmHC+uSv7mBBtSnVFIYSZkTtgr+iCznAoUMrNGe:hC2q9qsUZmmHMw7G2VFIYSZMisnAsGe
TLSH
T17B25A055E2E401F8E17BD674C9B2A61BDA36785617309ACF03D0056D3F336E44ABBB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc

.exe 946KB

2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 177735c577d39f85a45ccd460ee2b5ef
SHA256 0a460a14cb9a6724d8e88b6bf7b256f436620c2d4ae2e0a6fad3416cb3bcbe13
MD5 d264738640f8c1592710c9e3a08c79cc
SHA1 62050e51300e8843da645b963321669c626e2aea
SHA512 e306aee3346d3f684c5fc84b99ff94300fd5dc588a0904eb8ae4044c16e9fd4e2d7ff345ad8d1c003ea0acf183a05b846ea3cfd06f9cf20e323abdbf7d776d97
SSDEEP 12288:SUSBkC2q9qO1xfUx+irmmHC+uSv7mBBtSnVFIYSZkTtgr+iCznAoUMrNGe:hC2q9qsUZmmHMw7G2VFIYSZMisnAsGe
TLSH
T17B25A055E2E401F8E17BD674C9B2A61BDA36785617309ACF03D0056D3F336E44ABBB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

494976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d9

Direct3DCreate9

user32

DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage SetClipboardData PostQuitMessage UnregisterClassW SetProcessDPIAware MonitorFromWindow LoadCursorA ScreenToClient ClientToScreen SetCursor SetCursorPos ReleaseDC GetDC GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData RegisterClassExW CloseClipboard OpenClipboard LoadIconW LoadCursorW FindWindowW FrameRect FillRect GetCursorPos GetWindowRect GetClientRect InvalidateRect EndPaint BeginPaint SetForegroundWindow UpdateWindow TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu IsIconic IsWindowVisible SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassW

gdi32

CreateSolidBrush GetTextExtentPoint32W CreateFontW DeleteObject GetStockObject SetBkMode GetDeviceCaps SetBrushOrgEx TextOutW SetTextColor SetStretchBltMode StretchDIBits SelectObject

comdlg32

GetOpenFileNameW

shell32

SHGetFolderPathW SHBrowseForFolderW SHCreateDirectoryExW ShellExecuteW Shell_NotifyIconW SHGetPathFromIDListW

advapi32

RegCloseKey RegCreateKeyExW RegDeleteValueW RegQueryValueExW RegSetValueExW RegOpenKeyExW

ole32

CoTaskMemFree

kernel32

LoadLibraryExW VirtualProtect HeapFree HeapAlloc OutputDebugStringW UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread WriteConsoleW GetModuleHandleExW GetFileType GetStdHandle DeleteCriticalSection InitializeCriticalSectionEx LCMapStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadConsoleW SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle GetStringTypeW SetLastError CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx ReadFile SetFileAttributesW WriteFile CloseHandle GetLastError CancelIoEx ReleaseMutex WaitForSingleObject CreateMutexW Sleep GetExitCodeProcess CreateProcessW GetTickCount64 GetModuleFileNameW GetModuleHandleW CopyFileW MoveFileExW ReadDirectoryChangesW WideCharToMultiByte CreateToolhelp32Snapshot Process32NextW OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead HeapSize HeapReAlloc SetEndOfFile FlsAlloc Process32FirstW RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

637KB

Virtual Size

637KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

218KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_d264738640f8c1592710c9e3a08c79cc_cobalt-strike_icedid_njrat_satacom_stealc

d3d9

user32

gdi32

comdlg32

shell32

advapi32

ole32

kernel32

imm32

generic