2026-08-04_30f3e2962d9b956a1e05c3e2c52bde5c_cobalt-strike_icedid_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_30f3e2962d9b956a1e05c3e2c52bde5c_cobalt-strike_icedid_satacom_stealc
Size 260KB
Sample260804-jpdexsfe87
SHA256 cadad02d48ac1dda953679290033dac78ef4b268440979b1be24a3e861b3db6d
MD5 30f3e2962d9b956a1e05c3e2c52bde5c
SHA1 0c1adf5c8b8e069c42844ea47f3321f09aabf29e
SHA512 84d2e5e51d1b8ad49abf691814b5419a6b60ed49f650728b6c2086b056b7833799c222deea3329d5a8cf89749b70a327cca9dc28644fa93f86190d10ef54f6d7
SSDEEP 3072:VojtiAvJxL+zdswanUIJbeubA+ckR8zo/ds8SUGnQpzi4WLkGcM99cw7pestKB2E:S59qzAUIJbe2Xmz4duUyLcqGV
TLSH
T1CB447C16BB641CFDED6B817DC9424A06EB72BC564761E6CF03A04A970F236E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_30f3e2962d9b956a1e05c3e2c52bde5c_cobalt-strike_icedid_satacom_stealc

File Explorer

2026-08-04_30f3e2962d9b956a1e05c3e2c52bde5c_cobalt-strike_icedid_satacom_stealc

.exe 260KB

2026-08-04_30f3e2962d9b956a1e05c3e2c52bde5c_cobalt-strike_icedid_satacom_stealc

IMPHASH 0fff811284bad71e8c0bb263622c0917
SHA256 cadad02d48ac1dda953679290033dac78ef4b268440979b1be24a3e861b3db6d
MD5 30f3e2962d9b956a1e05c3e2c52bde5c
SHA1 0c1adf5c8b8e069c42844ea47f3321f09aabf29e
SHA512 84d2e5e51d1b8ad49abf691814b5419a6b60ed49f650728b6c2086b056b7833799c222deea3329d5a8cf89749b70a327cca9dc28644fa93f86190d10ef54f6d7
SSDEEP 3072:VojtiAvJxL+zdswanUIJbeubA+ckR8zo/ds8SUGnQpzi4WLkGcM99cw7pestKB2E:S59qzAUIJbe2Xmz4duUyLcqGV
TLSH
T1CB447C16BB641CFDED6B817DC9424A06EB72BC564761E6CF03A04A970F236E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48324

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\DLLs\Svchost2\x64\Release\Svchost2.pdb

gdiplus

GdipCloneImage GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdiplusStartup GdiplusShutdown GdipSaveImageToFile GdipAlloc

shell32

SHGetSpecialFolderPathA SHGetKnownFolderPath

advapi32

RegOpenKeyExA RegSetValueExA RegCloseKey

shlwapi

PathFileExistsA

ole32

CLSIDFromString CoTaskMemFree

kernel32

GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetModuleFileNameA FindFirstFileA FindNextFileA SetStdHandle WaitForSingleObject Sleep GetTempPathA CopyFileA DeleteFileA CloseHandle RemoveDirectoryA WideCharToMultiByte GetConsoleWindow CreateProcessA HeapReAlloc ReadConsoleW CreateDirectoryW ReadFile EnumSystemLocalesW GetProcessHeap CreateFileW HeapSize WriteConsoleW SetEndOfFile FindClose RtlLookupFunctionEntry EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwind RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID

user32

GetSystemMetrics GetDC ShowWindow ReleaseDC GetDesktopWindow

gdi32

DeleteObject CreateCompatibleBitmap SelectObject DeleteDC CreateCompatibleDC BitBlt

Name

.text

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_30f3e2962d9b956a1e05c3e2c52bde5c_cobalt-strike_icedid_satacom_stealc

gdiplus

shell32

advapi32

shlwapi

ole32

kernel32

user32

gdi32

generic