2026-08-07_81675cfb5211dc20cdbf89b5756e72ff_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_81675cfb5211dc20cdbf89b5756e72ff_cobalt-strike_icedid_njrat_satacom_stealc
Size 458KB
Sample260807-ykn37avyft
SHA256 eab711e6d34df59df993829b57412b922133e058bc8e38e223da66cf01067332
MD5 81675cfb5211dc20cdbf89b5756e72ff
SHA1 593a4ecd7fa552f600c5cbd7a4e196262614c90a
SHA512 90a9fdce1e7542869454bbc619f12893508aa01d86f71463d1d0cf2aac5c4282125e9ba4d2233077e19697fbe50a7c324f17bbdfa5c7ae72933369299c8a42d1
SSDEEP 6144:fI2Csj4INzNPzw9tY1tZTHPTthH2nat6cKtC4/rvXBAqn/TuWsYonF5wmnKd9aZc:Quj4EM9tMtFPbIZsFbKd94Qy/U+C
TLSH
T1CBA45C56A6A804F9E173D1BCCD574902E772784A0721EBCF0390EA761E276D49E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ClearWinLogs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_81675cfb5211dc20cdbf89b5756e72ff_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-07_81675cfb5211dc20cdbf89b5756e72ff_cobalt-strike_icedid_njrat_satacom_stealc

.exe 458KB

2026-08-07_81675cfb5211dc20cdbf89b5756e72ff_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH ecfcd78a7e817603543dc3571565b0fd
SHA256 eab711e6d34df59df993829b57412b922133e058bc8e38e223da66cf01067332
MD5 81675cfb5211dc20cdbf89b5756e72ff
SHA1 593a4ecd7fa552f600c5cbd7a4e196262614c90a
SHA512 90a9fdce1e7542869454bbc619f12893508aa01d86f71463d1d0cf2aac5c4282125e9ba4d2233077e19697fbe50a7c324f17bbdfa5c7ae72933369299c8a42d1
SSDEEP 6144:fI2Csj4INzNPzw9tY1tZTHPTthH2nat6cKtC4/rvXBAqn/TuWsYonF5wmnKd9aZc:Quj4EM9tMtFPbIZsFbKd94Qy/U+C
TLSH
T1CBA45C56A6A804F9E173D1BCCD574902E772784A0721EBCF0390EA761E276D49E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing commands for clearing Windows Event Logs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

191808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpSendRequest WinHttpReceiveResponse WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest WinHttpSetOption WinHttpOpen

gdi32

SelectObject BitBlt CreateCompatibleBitmap DeleteObject DeleteDC CreateCompatibleDC

user32

GetDC GetCursorPos MessageBoxA ShowWindow OpenClipboard CloseClipboard ReleaseDC GetSystemMetrics GetClipboardData

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey GetUserNameA RegSetValueExA

shell32

SHAddToRecentDocs ShellExecuteA

kernel32

GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsValidCodePage ReadConsoleW CreateFileW HeapSize WriteConsoleW SetEndOfFile SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx GetFileSizeEx GetConsoleMode GetCommandLineA CreateFileA ReadFile SetFileAttributesA WriteFile GetTempPathA CloseHandle SetHandleInformation GetLastError CreatePipe WaitForSingleObject CreateMutexA Sleep GetExitCodeProcess CreateProcessA GlobalMemoryStatusEx GetTickCount GetTickCount64 GetModuleFileNameA GetModuleHandleA LoadLibraryA GlobalUnlock GlobalLock LocalFree MoveFileA GetComputerNameA MultiByteToWideChar GetConsoleWindow CreateToolhelp32Snapshot Process32First Process32Next GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapAlloc HeapReAlloc HeapFree UnhandledExceptionFilter FormatMessageA GetLocaleInfoEx WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle RtlUnwind CreateFile2 AreFileApisANSI GetModuleHandleW GetProcAddress CopyFile2 GetFileInformationByHandleEx WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx GetStringTypeW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess GetModuleFileNameW GetStdHandle RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent

gdiplus

GdipCreateBitmapFromHBITMAP GdipGetImageEncoders GdipSaveImageToFile GdipDisposeImage GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipGetImageEncodersSize GdipAlloc

bcrypt

BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptDestroyKey BCryptDecrypt

Name

.text

Size

329KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_81675cfb5211dc20cdbf89b5756e72ff_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

gdi32

user32

advapi32

shell32

kernel32

gdiplus

bcrypt

generic