2026-08-06_bfbcc04a0402edc66eff267e9d0a8389_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_bfbcc04a0402edc66eff267e9d0a8389_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.6MB
Sample260806-bl2dksfa85
SHA256 4edf5c4912fe87f612b942edef6fcb3c11cdcef9299da2892c65c4b73ca608f9
MD5 bfbcc04a0402edc66eff267e9d0a8389
SHA1 2a52d344318550e2dbc4bcf09a0772e3c0ed04c6
SHA512 d9907acef04410602d59f7acc48a536bf66e2ba0919c3eff41c3a3007f84ecdbe1617edfff63faf68897e16df10a0c2334075cef9f80476eef2046f1850b503f
SSDEEP 24576:t94eJPQW4GLiEYUZs/X38zYO0UQzSoH3CiiWJWABhJlklPw7ZqhGM:0eJPNidUS/X38zaX2wyiXWfa
TLSH
T15C858E0AA2B900ECD1A7C17DCA165607EBB1B44513309ADF57D0CAA66F23EE15E7F720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_bfbcc04a0402edc66eff267e9d0a8389_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-06_bfbcc04a0402edc66eff267e9d0a8389_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.6MB

2026-08-06_bfbcc04a0402edc66eff267e9d0a8389_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH e05f589b5e0e04c0cc044889a9727ea6
SHA256 4edf5c4912fe87f612b942edef6fcb3c11cdcef9299da2892c65c4b73ca608f9
MD5 bfbcc04a0402edc66eff267e9d0a8389
SHA1 2a52d344318550e2dbc4bcf09a0772e3c0ed04c6
SHA512 d9907acef04410602d59f7acc48a536bf66e2ba0919c3eff41c3a3007f84ecdbe1617edfff63faf68897e16df10a0c2334075cef9f80476eef2046f1850b503f
SSDEEP 24576:t94eJPQW4GLiEYUZs/X38zYO0UQzSoH3CiiWJWABhJlklPw7ZqhGM:0eJPNidUS/X38zaX2wyiXWfa
TLSH
T15C858E0AA2B900ECD1A7C17DCA165607EBB1B44513309ADF57D0CAA66F23EE15E7F720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1189296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpWriteData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpOpen WinHttpReceiveResponse WinHttpQueryHeaders

crypt32

CryptUnprotectData CryptStringToBinaryA

ncrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptSetProperty BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey NCryptOpenStorageProvider NCryptOpenKey NCryptDecrypt NCryptFreeObject BCryptGenerateSymmetricKey

advapi32

RevertToSelf AdjustTokenPrivileges FreeSid CheckTokenMembership AllocateAndInitializeSid LookupPrivilegeValueA OpenProcessToken ImpersonateLoggedOnUser DuplicateTokenEx

user32

ShowWindow

shell32

ShellExecuteExA

kernel32

GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation SetStdHandle IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW LoadLibraryExW VirtualProtect UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCommandLineW CompareStringW GetFullPathNameW FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA CloseHandle GetCurrentProcess OpenProcess LocalFree CreateToolhelp32Snapshot Process32FirstW Process32NextW GetTempPathA IsDebuggerPresent Sleep GetCurrentProcessId GetSystemTime GetTickCount GetModuleFileNameA GetComputerNameA GetConsoleWindow FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime WideCharToMultiByte SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetLastError GetDiskFreeSpaceA FormatMessageW MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile RtlUnwind HeapFree HeapCreate ReadFile AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileInformationByHandle CreateFile2 GetModuleHandleW GetFileInformationByHandleEx QueryPerformanceFrequency InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead GetCommandLineA RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess TerminateProcess CreateThread ExitThread FreeLibraryAndExitThread GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime IsProcessorFeaturePresent

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

229KB

Virtual Size

229KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_bfbcc04a0402edc66eff267e9d0a8389_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

crypt32

ncrypt

advapi32

user32

shell32

kernel32

generic