2026-08-06_dbbaf114d30472cd5e6b735fe86eb48b_cobalt-strike_icedid_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_dbbaf114d30472cd5e6b735fe86eb48b_cobalt-strike_icedid_satacom_stealc
Size 150KB
Sample260806-lr4e8shk2w
SHA256 f9e11667cfea6a9fd582588049e485646cfdc176957c8025a5437ab3caccc75a
MD5 dbbaf114d30472cd5e6b735fe86eb48b
SHA1 8b9f17454a35c7b1dafa09b84949ac3bdded9e30
SHA512 0294accbf12f21f22ab5a99d5c0b0cea8c6af60b86b78ab2af427385cf84132e4123dda529cf0d153348b0be2a10fddf292d78d18ab74e41909ba74a95798e55
SSDEEP 3072:TPJ7NhSPWYsdJOvGSnS9njQVcxEPiEIj5f9snQWYZPi:8KeS5+cssIQWK
TLSH
T141E34C17B6A930FAE167C938C5920905FB727C728790ABDF43500AB61E677D09E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_dbbaf114d30472cd5e6b735fe86eb48b_cobalt-strike_icedid_satacom_stealc

File Explorer

2026-08-06_dbbaf114d30472cd5e6b735fe86eb48b_cobalt-strike_icedid_satacom_stealc

.exe 150KB

2026-08-06_dbbaf114d30472cd5e6b735fe86eb48b_cobalt-strike_icedid_satacom_stealc

IMPHASH 803e5de910617bb281e4c061910e2c68
SHA256 f9e11667cfea6a9fd582588049e485646cfdc176957c8025a5437ab3caccc75a
MD5 dbbaf114d30472cd5e6b735fe86eb48b
SHA1 8b9f17454a35c7b1dafa09b84949ac3bdded9e30
SHA512 0294accbf12f21f22ab5a99d5c0b0cea8c6af60b86b78ab2af427385cf84132e4123dda529cf0d153348b0be2a10fddf292d78d18ab74e41909ba74a95798e55
SSDEEP 3072:TPJ7NhSPWYsdJOvGSnS9njQVcxEPiEIj5f9snQWYZPi:8KeS5+cssIQWK
TLSH
T141E34C17B6A930FAE167C938C5920905FB727C728790ABDF43500AB61E677D09E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile

ntdll

RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlAddFunctionTable

kernel32

WriteConsoleW CreateFileW GetProcessId CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle GetProcAddress GetCurrentProcessId GetModuleHandleW WriteProcessMemory Sleep LoadLibraryA VirtualProtectEx VirtualAllocEx GetEnvironmentStringsW CreateRemoteThread VirtualFreeEx GetExitCodeProcess SetConsoleTitleA GetCurrentProcess OpenProcess GetTickCount64 FreeConsole CreateProcessW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FreeEnvironmentStringsW ReadProcessMemory MultiByteToWideChar HeapSize HeapReAlloc GetProcessHeap QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive GetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer FindFirstFileExW WideCharToMultiByte WakeAllConditionVariable GetStringTypeW GetCPInfo RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter HeapAlloc SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree VirtualProtect LoadLibraryExW LCMapStringW FindClose SetStdHandle

user32

GetAsyncKeyState DispatchMessageW PeekMessageW TranslateMessage

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

Name

.text

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_dbbaf114d30472cd5e6b735fe86eb48b_cobalt-strike_icedid_satacom_stealc

wininet

ntdll

kernel32

user32

advapi32

generic