2026-08-04_429751ea98b7fe269ba6edaf9e5b1215_cobalt-strike_icedid_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_429751ea98b7fe269ba6edaf9e5b1215_cobalt-strike_icedid_satacom_stealc
Size 278KB
Sample260804-jddljsfc74
SHA256 9d88986bf8d0def8b28cad2a027e3ec0e03cac1d1ce9408a023e0ad3ea22745a
MD5 429751ea98b7fe269ba6edaf9e5b1215
SHA1 b692d5562a593aefbf3ca3b1cbded861d83d3185
SHA512 1e614a9937a70a50640f6b7fba35fc242e9fc05a6461c76ecbf97337dd260e647b524abf1c9d492124e17905c585626bb6c304a712a782c5ae1d6627e9759de4
SSDEEP 3072:c3Xrk72zqojJcBZ72mcfmm3RJxhrdgijBGdSREIgVHfXRsDExPcLMuKpV6wPVXxC:SXrk7iHjJFppbjBeylSKD5sdms2
TLSH
T17E546C26B7A418FDE9A7C17DC9424902EB72BC464361EADF03E04AA71F176D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_429751ea98b7fe269ba6edaf9e5b1215_cobalt-strike_icedid_satacom_stealc

File Explorer

2026-08-04_429751ea98b7fe269ba6edaf9e5b1215_cobalt-strike_icedid_satacom_stealc

.exe 278KB

2026-08-04_429751ea98b7fe269ba6edaf9e5b1215_cobalt-strike_icedid_satacom_stealc

IMPHASH aa6d0055aa55d17c66469a18b31cbc97
SHA256 9d88986bf8d0def8b28cad2a027e3ec0e03cac1d1ce9408a023e0ad3ea22745a
MD5 429751ea98b7fe269ba6edaf9e5b1215
SHA1 b692d5562a593aefbf3ca3b1cbded861d83d3185
SHA512 1e614a9937a70a50640f6b7fba35fc242e9fc05a6461c76ecbf97337dd260e647b524abf1c9d492124e17905c585626bb6c304a712a782c5ae1d6627e9759de4
SSDEEP 3072:c3Xrk72zqojJcBZ72mcfmm3RJxhrdgijBGdSREIgVHfXRsDExPcLMuKpV6wPVXxC:SXrk7iHjJFppbjBeylSKD5sdms2
TLSH
T17E546C26B7A418FDE9A7C17DC9424902EB72BC464361EADF03E04AA71F176D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

66548

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\DLLs\Svchost2\x64\Release\Svchost2.pdb

gdiplus

GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdipSaveImageToFile GdiplusStartup GdiplusShutdown

shell32

SHGetSpecialFolderPathA SHFileOperationA

advapi32

RegOpenKeyExA RegSetValueExA RegCloseKey

shlwapi

PathIsDirectoryA PathFileExistsA

winhttp

WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpReceiveResponse WinHttpOpen WinHttpOpenRequest

winmm

timeBeginPeriod

ole32

CoCreateInstance CoUninitialize CoInitialize CLSIDFromString

oleaut32

SysAllocString VariantInit VariantClear

kernel32

GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW SetStdHandle VirtualProtect GetModuleFileNameA FindFirstFileA GetCurrentProcess FindNextFileA FindClose Sleep GetTempPathA GetTickCount64 CopyFileA LoadLibraryA DeleteFileA GetSystemInfo SetFileAttributesA GetProcAddress GlobalMemoryStatusEx FreeLibrary GetConsoleWindow CreateDirectoryA GetComputerNameA HeapAlloc GetFileAttributesExW CreateProcessW GetExitCodeProcess WaitForSingleObject CloseHandle GetProcessHeap CreateFileW HeapSize WriteConsoleW SetEndOfFile LoadLibraryExW GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx RtlUnwind GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW ExitProcess TerminateProcess GetModuleHandleExW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree

user32

GetDesktopWindow ShowWindow GetSystemMetrics GetDC ReleaseDC

gdi32

DeleteObject CreateCompatibleBitmap SelectObject DeleteDC CreateCompatibleDC BitBlt

Name

.text

Size

182KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_429751ea98b7fe269ba6edaf9e5b1215_cobalt-strike_icedid_satacom_stealc

gdiplus

shell32

advapi32

shlwapi

winhttp

winmm

ole32

oleaut32

kernel32

user32

gdi32

generic