2026-08-03_ecb17d7b232e08366248c338646c6595_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-08-03_ecb17d7b232e08366248c338646c6595_cobalt-strike_icedid_njrat_satacom_stealc
Size 204KB
Sample260804-k2h2lsge96
SHA256 91745f012cb29fb94f1aebf0d0c4751fb7a6fc6dfe3290c078eb3ac89fc40e1f
MD5 ecb17d7b232e08366248c338646c6595
SHA1 9befce8e8c14b7010fbf3b9293c7da977e05f8dd
SHA512 0775d2981fa405bd6507d1617a5f523ac7f6d9c157a2921457708fabd6876934b59ad9d003c23f7009f9676fecd873bee340c20e6863c5dd88bc583e13d6f7f7
SSDEEP 3072:hJ81+hCv1DjkN5Q30bF2r9S6DTleT16nd/dkExO4QXnm+ZCoKGs8:axVTls89K7PEofs8
TLSH
T10C146B4AB6A604F5D5B7C138C892661AF67234550730DBEB47A04B7AAF237D0DC7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_ecb17d7b232e08366248c338646c6595_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-03_ecb17d7b232e08366248c338646c6595_cobalt-strike_icedid_njrat_satacom_stealc

.exe 204KB

2026-08-03_ecb17d7b232e08366248c338646c6595_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH a8e7407663b1ba856aa055e4cc007cb0
SHA256 91745f012cb29fb94f1aebf0d0c4751fb7a6fc6dfe3290c078eb3ac89fc40e1f
MD5 ecb17d7b232e08366248c338646c6595
SHA1 9befce8e8c14b7010fbf3b9293c7da977e05f8dd
SHA512 0775d2981fa405bd6507d1617a5f523ac7f6d9c157a2921457708fabd6876934b59ad9d003c23f7009f9676fecd873bee340c20e6863c5dd88bc583e13d6f7f7
SSDEEP 3072:hJ81+hCv1DjkN5Q30bF2r9S6DTleT16nd/dkExO4QXnm+ZCoKGs8:axVTls89K7PEofs8
TLSH
T10C146B4AB6A604F5D5B7C138C892661AF67234550730DBEB47A04B7AAF237D0DC7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

39072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxW FillRect ClientToScreen GetClientRect EndPaint BeginPaint ReleaseDC GetDC UpdateWindow SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage FindWindowW GetAsyncKeyState

gdi32

TextOutW MoveToEx SetTextColor SetBkMode SelectObject LineTo GetTextExtentPoint32W GetStockObject DeleteObject CreateSolidBrush CreatePen CreateFontW

kernel32

GetProcessHeap LCMapStringW LoadLibraryExW VirtualProtect SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode CreateFileW WriteConsoleW FlsSetValue CloseHandle WaitForSingleObject Sleep OpenProcess ReadProcessMemory WriteProcessMemory WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW

Name

.text

Size

135KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_ecb17d7b232e08366248c338646c6595_cobalt-strike_icedid_njrat_satacom_stealc

user32

gdi32

kernel32

generic