2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc
Size 365KB
Sample260808-dxsxpasthy
SHA256 4e4b3cb215c162cf312c5177043947bbd3d654118b3ca7ed63af5d01eadfa537
MD5 6fe3306248c933240d34f9e0b7e4c012
SHA1 bece26b9cf43cd4a0d3863c48dba7072155de7ba
SHA512 b221714ab268ed39e5cfb66abed30385f78abafdacb3bdbc1488d6e2d88a0252db783b8a5a1a18e573b3fbf8085e4b6bd110fa5a31341755149f4ff1aa37963b
SSDEEP 6144:6xEZwfNSPYm1ESU3SPRpowRBZQbL1Ay6etyJOhcRXQZbdsanl6N:6TECjOZQbhd6C8acRgJ6anlo
TLSH
T1D5847D19FBA404F9E1B7D17CC9634501EB727C9A4770AACF23A44AA61F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc

.exe 365KB

2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 25e4b7b792aa504816ebcbe00bbd6529
SHA256 4e4b3cb215c162cf312c5177043947bbd3d654118b3ca7ed63af5d01eadfa537
MD5 6fe3306248c933240d34f9e0b7e4c012
SHA1 bece26b9cf43cd4a0d3863c48dba7072155de7ba
SHA512 b221714ab268ed39e5cfb66abed30385f78abafdacb3bdbc1488d6e2d88a0252db783b8a5a1a18e573b3fbf8085e4b6bd110fa5a31341755149f4ff1aa37963b
SSDEEP 6144:6xEZwfNSPYm1ESU3SPRpowRBZQbL1Ay6etyJOhcRXQZbdsanl6N:6TECjOZQbhd6C8acRgJ6anlo
TLSH
T1D5847D19FBA404F9E1B7D17CC9634501EB727C9A4770AACF23A44AA61F236D09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

107984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\no\HELL NO\Exec\x64\Release\idkikdikdikdikdidkdiddi.pdb

kernel32

HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetCommandLineA CreateProcessW VirtualProtect GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapAlloc HeapFree GetFileType SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile GetSystemTimeAsFileTime WideCharToMultiByte CopyFileW GetComputerNameW ExitProcess MoveFileExW LocalFree GetLocalTime CloseHandle DeleteFileW GetLastError MultiByteToWideChar SetFileAttributesW GetFileAttributesW CreateFileW GetTempPathW GetModuleFileNameW IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle LoadLibraryExW GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FormatMessageA GetLocaleInfoEx GetStringTypeW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 GetModuleHandleW GetProcAddress GetFileInformationByHandleEx GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc RtlUnwind

user32

GetCursorPos ReleaseDC InvalidateRect EndPaint PtInRect SetProcessDPIAware SystemParametersInfoW PostQuitMessage BeginPaint GetWindowTextW UpdateWindow KillTimer GetMessageW DefWindowProcW GetWindowRect DestroyWindow GetDC SetWindowPos MessageBoxW FillRect CreateWindowExW SendMessageW GetSystemMetrics SetWindowTextW GetWindowLongPtrW RegisterClassExW ShowWindow DispatchMessageW SetTimer IsDialogMessageW TrackMouseEvent FrameRect SetFocus TranslateMessage LoadCursorW GetClientRect GetDlgItem DrawTextW

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateFontW GetDIBits DeleteDC SetTextColor SetBkMode GetObjectW SetBkColor Ellipse DeleteObject CreateSolidBrush

advapi32

RegCreateKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW LookupPrivilegeValueW SetSecurityDescriptorDacl AdjustTokenPrivileges RegCloseKey SetFileSecurityW RegQueryValueExW RegSetValueExW OpenProcessToken InitializeSecurityDescriptor RegOpenKeyExW RegDeleteValueW

shell32

SHGetKnownFolderPath SHGetFolderPathW

ole32

CoTaskMemFree

comctl32

InitCommonControlsEx

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData

Name

.text

Size

245KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_6fe3306248c933240d34f9e0b7e4c012_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

comctl32

winhttp

generic