2026-08-03_11df1466dd847070ff402a526b9aba91_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_11df1466dd847070ff402a526b9aba91_cobalt-strike_icedid_njrat_satacom_stealc
Size 14.1MB
Sample260804-dy9a3acc62
SHA256 d25aa7bd5aa7f7b6ae23956e74ed43a61c21e77aae5374c02554e37bdf8e4766
MD5 11df1466dd847070ff402a526b9aba91
SHA1 e8f4d212577c1ca7e170193ef813f83dc8d1524e
SHA512 b7abcc9541f338108c6b0742ba8a9b85bfd9f22652fcb999b8a36fd5527f7dda632a77b2d28b1f969bb069d051faeb50ba0ae1a57a1f3d5f2f305020162aa179
SSDEEP 196608:4agvHVFCLtykTAL/XtiEATW6qag156mxIBh3oQlxu26Es7K2enhk+X:ev1FC01rcEAxqhSIIBpoQlxLdgenhk+X
TLSH
T1CBE6AE0AAB1551BDC077D63196159336FABA786407344E8757903FFA1BB9AE0AB3C3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-03_11df1466dd847070ff402a526b9aba91_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-03_11df1466dd847070ff402a526b9aba91_cobalt-strike_icedid_njrat_satacom_stealc

.exe 14.1MB

2026-08-03_11df1466dd847070ff402a526b9aba91_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 12ecbf87485be7479b3fd3b64526279c
SHA256 d25aa7bd5aa7f7b6ae23956e74ed43a61c21e77aae5374c02554e37bdf8e4766
MD5 11df1466dd847070ff402a526b9aba91
SHA1 e8f4d212577c1ca7e170193ef813f83dc8d1524e
SHA512 b7abcc9541f338108c6b0742ba8a9b85bfd9f22652fcb999b8a36fd5527f7dda632a77b2d28b1f969bb069d051faeb50ba0ae1a57a1f3d5f2f305020162aa179
SSDEEP 196608:4agvHVFCLtykTAL/XtiEATW6qag156mxIBh3oQlxu26Es7K2enhk+X:ev1FC01rcEAxqhSIIBpoQlxLdgenhk+X
TLSH
T1CBE6AE0AAB1551BDC077D63196159336FABA786407344E8757903FFA1BB9AE0AB3C3C0
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

cb:f6:b0:ff:36:5b:77:c5:5b:3c:26:6b:c3:a0:1d:33:90:8f:ee:2f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US

Chains

Jul 30, 2026

CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US

Subject

CN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=US

Serial Number

14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2015 - Jul 26, 2018

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

4759376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

ExitProcess MultiByteToWideChar GetCommandLineA WTSGetActiveConsoleSessionId GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency GetLocaleInfoA CreateFileA IsDebuggerPresent CheckRemoteDebuggerPresent SetUnhandledExceptionFilter SleepEx GetCurrentProcessId TerminateProcess CreateThread GetCurrentThread GetThreadContext GetTickCount VirtualAlloc K32EnumProcesses K32EnumProcessModules K32GetModuleBaseNameA VirtualFree AddVectoredExceptionHandler RemoveVectoredExceptionHandler GetSystemInfo K32GetModuleInformation VirtualQuery GetModuleHandleExW SetHandleInformation CreateMutexA RaiseException GetEnvironmentVariableW HeapQueryInformation GetWriteWatch ResetWriteWatch GetBinaryTypeW GlobalGetAtomNameA GetProcessTimes GetSystemTimeAsFileTime HeapSize CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW LoadLibraryExW InitializeCriticalSectionAndSpinCount GetFileType UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent GetVolumeInformationW ExitThread RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader InitializeSListHead GetStartupInfoW GetCPInfo CompareStringEx WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetStringTypeW GetFileInformationByHandleEx AreFileApisANSI K32GetModuleFileNameExA Module32Next Module32First Process32Next Process32First CreateToolhelp32Snapshot LoadLibraryA GetProcAddress GetModuleHandleW GetModuleHandleA SetEndOfFile FreeLibrary VirtualFreeEx WriteProcessMemory ReadProcessMemory VirtualProtectEx VirtualAllocEx OpenProcess Sleep WaitForSingleObject GetLastError CloseHandle WideCharToMultiByte VirtualProtect FlushInstructionCache GetCurrentProcess GetTickCount64 CreateFile2 GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx LocalFree WaitForSingleObjectEx FormatMessageA GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread FreeLibraryAndExitThread WriteConsoleW GetDateFormatW CreateFileMappingA UnmapViewOfFile MapViewOfFile GetProcessHeap GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree

user32

GetCursorPos PeekMessageA DefWindowProcA PostQuitMessage RegisterClassA UnregisterClassW RegisterClassExW CreateWindowExA CreateWindowExW GetPhysicalCursorPos mouse_event IsWindow DestroyWindow SetLayeredWindowAttributes GetAsyncKeyState IsIconic UpdateWindow GetDC ReleaseDC BeginPaint EndPaint GetClientRect GetWindowRect ClientToScreen ShowWindow SetWindowDisplayAffinity SetForegroundWindow GetWindowLongA SetWindowLongA TranslateMessage GetForegroundWindow SetWindowPos SetCursorPos FillRect MapVirtualKeyA GetKeyNameTextA LoadIconA GetWindowThreadProcessId MessageBoxA GetSystemMetrics LoadCursorA ScreenToClient SetCursor FindWindowA IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard EnumDisplayMonitors GetMonitorInfoA MonitorFromWindow EnumDisplaySettingsA DispatchMessageA

gdi32

CreateSolidBrush StretchBlt SetStretchBltMode BitBlt

advapi32

RegDeleteValueA AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegCloseKey GetTokenInformation OpenProcessToken

shell32

SHGetKnownFolderPath ShellExecuteW

ole32

PropVariantClear CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

ntdll

ZwReadVirtualMemory ZwWriteVirtualMemory

wtsapi32

WTSQueryUserToken

wininet

InternetSetOptionA InternetReadFile InternetOpenA InternetCloseHandle InternetOpenUrlA

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_11df1466dd847070ff402a526b9aba91_cobalt-strike_icedid_njrat_satacom_stealc

PE Signature issue

d3d11

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

ntdll

wtsapi32

wininet

imm32

d3dcompiler_47

dwmapi

generic