2026-08-04_b311457c6e2d94fb57850cd2daed98b4_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_b311457c6e2d94fb57850cd2daed98b4_cobalt-strike_icedid_njrat_satacom_stealc
Size 2.3MB
Sample260804-rv4s3azset
SHA256 7ac1bfec3f61103a60e46f55a7fc1f396148ab5ffb1ca3bffd0af9b7a4923538
MD5 b311457c6e2d94fb57850cd2daed98b4
SHA1 fc63c1b15c3cd18271f6fdfc81128f0598bd3b8c
SHA512 39c22902c223a516319738f168a785a02fe7689811cf93014649ef6ba5be092694c9fd771507ee6771c7af6dee4e9cd4eb172c7499969b97e4174ae3f599d861
SSDEEP 49152:w5W73lCej7t0Pct+U6HsdDL1P11ol5j0erP4ty:jCaIHsBuFP4o
TLSH
T10CB5BF5AA6F540ECC177D078C596AA0BE771380D0320AEEF23D04E966F63AE15F7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_b311457c6e2d94fb57850cd2daed98b4_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-04_b311457c6e2d94fb57850cd2daed98b4_cobalt-strike_icedid_njrat_satacom_stealc

.exe 2.3MB

2026-08-04_b311457c6e2d94fb57850cd2daed98b4_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 95fe04523d5f6565710ad5dbcb431357
SHA256 7ac1bfec3f61103a60e46f55a7fc1f396148ab5ffb1ca3bffd0af9b7a4923538
MD5 b311457c6e2d94fb57850cd2daed98b4
SHA1 fc63c1b15c3cd18271f6fdfc81128f0598bd3b8c
SHA512 39c22902c223a516319738f168a785a02fe7689811cf93014649ef6ba5be092694c9fd771507ee6771c7af6dee4e9cd4eb172c7499969b97e4174ae3f599d861
SSDEEP 49152:w5W73lCej7t0Pct+U6HsdDL1P11ol5j0erP4ty:jCaIHsBuFP4o
TLSH
T10CB5BF5AA6F540ECC177D078C596AA0BE771380D0320AEEF23D04E966F63AE15F7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1506832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpConnect WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryDataAvailable

kernel32

GetModuleFileNameA SetThreadPriority GetCurrentThreadId GetModuleHandleA Sleep GetTickCount64 GetCurrentThread QueryPerformanceFrequency CloseHandle GetProcAddress QueryPerformanceCounter AllocConsole OpenProcess CreateToolhelp32Snapshot Process32NextW Module32FirstW ReadProcessMemory SetLastError LoadLibraryA GetSystemInfo VirtualProtectEx GetModuleHandleW FlushInstructionCache Module32NextW VirtualQueryEx GetFileAttributesA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA FreeLibrary CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection VirtualProtect GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FreeEnvironmentStringsW GetConsoleMode LoadLibraryExW GetFileType SetFilePointerEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA GetModuleFileNameW WriteFile GetStdHandle IsProcessorFeaturePresent TerminateProcess ExitProcess GetCurrentProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetCPInfo GetStringTypeW WakeAllConditionVariable LCMapStringEx DecodePointer ReadConsoleW GetTimeZoneInformation IsValidCodePage SetEnvironmentVariableW SetStdHandle CreateFileW HeapSize WriteConsoleW SetFileInformationByHandle EncodePointer DeleteCriticalSection InitializeCriticalSectionEx GetFileInformationByHandleEx AreFileApisANSI CreateFile2 GetACP GetOEMCP GetEnvironmentStringsW CompareStringW SetEndOfFile FormatMessageA ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared SleepConditionVariableSRW GetLastError LocalFree GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW

user32

IsWindow SendInput GetCursorPos SetWindowsHookExW FindWindowW TranslateMessage UnhookWindowsHookEx PeekMessageW DispatchMessageW GetAsyncKeyState MsgWaitForMultipleObjects CallNextHookEx PostMessageW GetKeyState GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout SetCapture GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowLongW DefWindowProcW DestroyWindow SetWindowPos CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow FindWindowA GetKeyNameTextA SetWindowDisplayAffinity GetForegroundWindow SetLayeredWindowAttributes LoadCursorW SetCursor SetWindowLongW PostQuitMessage UpdateWindow SetForegroundWindow GetWindowRect ScreenToClient

advapi32

RegQueryValueExA SystemFunction036 RegCloseKey RegOpenKeyExA

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance CoUninitialize

winmm

timeEndPeriod timeBeginPeriod

wininet

InternetCloseHandle InternetReadFile InternetOpenA InternetOpenUrlA

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

553KB

Virtual Size

553KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_b311457c6e2d94fb57850cd2daed98b4_cobalt-strike_icedid_njrat_satacom_stealc

d3d11

dwmapi

winhttp

kernel32

user32

advapi32

shell32

ole32

winmm

wininet

imm32

d3dcompiler_47

generic