2026-08-04_8770468046581e19ca56135cf60ee24a_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_8770468046581e19ca56135cf60ee24a_cobalt-strike_icedid_njrat_satacom_stealc
Size 493KB
Sample260804-shd8batane
SHA256 4e782c9f9c708ed32adef4ac4af1ee7c3fbb416082d7ef86b323cb7d0dd14fff
MD5 8770468046581e19ca56135cf60ee24a
SHA1 ff67b64110fc709d67b6eb9a733c6bf16972579f
SHA512 ea2ba846cce353ea61997ca93e3923f2ffdbfee7873ac4201082378315e0a2ff0911e60d4c1c42519fb069455ef63a3ed78816f504b835671ed60a3ea778f7fc
SSDEEP 6144:OZqQNrIjx1gfYlz41cgt9/YkaQlwcnusXH9e:ECxIYt41hYkapvy9e
TLSH
T15EB46D57A61004E5E9634778C5921A22DAB57CA2BF70D9CF53A13AA21F373E0DC3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-04_8770468046581e19ca56135cf60ee24a_cobalt-strike_icedid_njrat_satacom_stealc

.exe 493KB

2026-08-04_8770468046581e19ca56135cf60ee24a_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 46dcfb7051820e9ff4f3e8fc787c84e9
SHA256 4e782c9f9c708ed32adef4ac4af1ee7c3fbb416082d7ef86b323cb7d0dd14fff
MD5 8770468046581e19ca56135cf60ee24a
SHA1 ff67b64110fc709d67b6eb9a733c6bf16972579f
SHA512 ea2ba846cce353ea61997ca93e3923f2ffdbfee7873ac4201082378315e0a2ff0911e60d4c1c42519fb069455ef63a3ed78816f504b835671ed60a3ea778f7fc
SSDEEP 6144:OZqQNrIjx1gfYlz41cgt9/YkaQlwcnusXH9e:ECxIYt41hYkapvy9e
TLSH
T15EB46D57A61004E5E9634778C5921A22DAB57CA2BF70D9CF53A13AA21F373E0DC3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

63:97:c5:d7:fd:57:bc:0e:02:24:41:94:63:60:02:c8:27:8d:e2:2b:41:ea:34:d9:42:b4:01:bb:31:5a:fc:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91310114MA1GW1DE8X,CN=上海莎纪网络科技有限公司,O=上海莎纪网络科技有限公司,ST=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e59889e5ae9ae58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 22, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

30:28:cf:a7:a4:45:a1:20:03:d6:b3:af:cc:15:fe:a2:b9:d9:f3:6e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Jul 22, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

02:08:ae:b4:81:7c:2a:2b:2d:d7:7f:97:c2:12:66:31

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 2, 2026 - May 29, 2027

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

66992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\张\source\repos\ConsoleApplication2\x64\Release\chatgetname.pdb

kernel32

GetModuleFileNameW OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetTickCount64 Process32NextW Process32FirstW CloseHandle GetSystemInfo Module32FirstW ReadProcessMemory WideCharToMultiByte Module32NextW SetConsoleTitleW VirtualQueryEx SetEndOfFile WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW RtlUnwind

user32

SendMessageW FindWindowW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

210KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_8770468046581e19ca56135cf60ee24a_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

version

generic