2026-08-04_acade77c20de5ad0bab890223656ce5e_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_acade77c20de5ad0bab890223656ce5e_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.9MB
Sample260804-ryggyaztcs
SHA256 82f1ae3eb7962908a03a993a02ae794477cb59d6d1f348641edf8ef342ccec0a
MD5 acade77c20de5ad0bab890223656ce5e
SHA1 9912796e0089630e2d41785fcbf26b07f99dc44a
SHA512 45d9d63dd559581169eb392985762e8dbffce2b889b864893bdd1a7881d0937354903a45fd08fd5f00fd0bac06fa15e443c49b57712c8158fa023f19d7da43bf
SSDEEP 49152:ZTnlqYrhX5Ken7NxQyFRwxCph0nK0ZYtTj6MPnh8i:ZlFpZnhxLyxWEy6MPn3
TLSH
T1E9958E56B39851E4F1F7C17DCAD7494BEBB27809032196DB06E0469A1F27EE80E7E324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_acade77c20de5ad0bab890223656ce5e_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-04_acade77c20de5ad0bab890223656ce5e_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.9MB

2026-08-04_acade77c20de5ad0bab890223656ce5e_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH a9dcb6a7aba227a80918d480fb89a584
SHA256 82f1ae3eb7962908a03a993a02ae794477cb59d6d1f348641edf8ef342ccec0a
MD5 acade77c20de5ad0bab890223656ce5e
SHA1 9912796e0089630e2d41785fcbf26b07f99dc44a
SHA512 45d9d63dd559581169eb392985762e8dbffce2b889b864893bdd1a7881d0937354903a45fd08fd5f00fd0bac06fa15e443c49b57712c8158fa023f19d7da43bf
SSDEEP 49152:ZTnlqYrhX5Ken7NxQyFRwxCph0nK0ZYtTj6MPnh8i:ZlFpZnhxLyxWEy6MPn3
TLSH
T1E9958E56B39851E4F1F7C17DCAD7494BEBB27809032196DB06E0469A1F27EE80E7E324
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

645072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\krmv\Desktop\Andromeda-CS2-Base-master\x64\Release\Andromeda-CS2-Base.pdb

kernel32

GetCurrentProcess OpenProcess GetModuleFileNameA lstrcatA lstrlenA CreateToolhelp32Snapshot Process32First Process32Next RtlUnwind CompareStringEx LCMapStringEx DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap Sleep GetLocaleInfoEx FormatMessageA HeapFree HeapAlloc GetLastError CloseHandle EnterCriticalSection GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection GetFileAttributesW MultiByteToWideChar FormatMessageW LocalFree GetModuleHandleW WideCharToMultiByte Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetSystemTimeAsFileTime QueryPerformanceCounter VirtualFree VirtualAlloc TerminateProcess ResumeThread Process32NextW Process32FirstW CreateProcessW GetExitCodeProcess GetSystemInfo VirtualAllocEx VirtualFreeEx GetCurrentThread GetProcAddress CreateActCtxW WriteFile GetTempPathW CreateFileW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW GetNativeSystemInfo WaitForSingleObject DuplicateHandle ResetEvent GetTickCount DeviceIoControl Thread32Next Thread32First GetCurrentThreadId GetCurrentProcessId CreateNamedPipeW TerminateThread DecodePointer ConnectNamedPipe WaitForDebugEvent DebugActiveProcessStop ContinueDebugEvent GetExitCodeThread DebugActiveProcess DebugSetProcessKillOnExit CheckRemoteDebuggerPresent GetProcessId IsWow64Process WriteProcessMemory VirtualProtectEx GetThreadContext ReadProcessMemory CreateRemoteThread SetThreadContext VirtualQueryEx LoadLibraryW FreeLibrary SuspendThread GetThreadTimes OpenThread IsDebuggerPresent OutputDebugStringW RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent ExitProcess GetModuleHandleExW GetStdHandle GetCommandLineA GetCommandLineW IsThreadAFiber VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc HeapSize FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetConsoleCtrlHandler SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW WriteConsoleW ReadFile GetFileSize GetFileAttributesA CreateFileA CreateThread GetCurrentDirectoryA GetTimeZoneInformation

user32

UnregisterClassA UnregisterClassW wsprintfW

advapi32

RegCloseKey OpenThreadToken RegQueryValueExW LookupPrivilegeValueW RegEnumValueW RegOpenKeyExW RegOpenKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCreateKeyW RegSetValueExW LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken

ole32

CoCreateInstance CoUninitialize CoInitialize

shlwapi

SHDeleteKeyW

oleaut32

SysFreeString

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

291KB

Virtual Size

291KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_acade77c20de5ad0bab890223656ce5e_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

ole32

shlwapi

oleaut32

generic