2026-08-08_569fdb1eae0089c1fb128b9310b53e7e_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_569fdb1eae0089c1fb128b9310b53e7e_cobalt-strike_icedid_njrat_satacom_stealc
Size 2.5MB
Sample260808-jk2a7acd59
SHA256 2a3ae9451d6330bb2fd2d0263f947be86e6b0030602c3dbf439030d783ad6a24
MD5 569fdb1eae0089c1fb128b9310b53e7e
SHA1 7d4b10a89752f8ab16af55649f25fdd9e56a049d
SHA512 445f126d5e7aea051808b2f3de7cf43cf245e563a60eb1e0f1e0ae07a7a05d1661c4f54cbb829eb43b5d102400e617db42d535b6b34eef25867ba560e14c8bfa
SSDEEP 49152:luUfb352ZHlYrvKjz+WjO4Li5YrVma37LpvgY1qFshlOjsMzA24qL5Ged6Tz6:ztm+WLLiux5PpvgeqFKOjs2ZJJd6T
TLSH
T1EBC51216E6A500FDD1B791B8D9630806E6727C8A0360DEDF0354EBA61F276E09F3BB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_569fdb1eae0089c1fb128b9310b53e7e_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-08_569fdb1eae0089c1fb128b9310b53e7e_cobalt-strike_icedid_njrat_satacom_stealc

.exe 2.5MB

2026-08-08_569fdb1eae0089c1fb128b9310b53e7e_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 97215c50343b98ffb045aa4bd681d8d3
SHA256 2a3ae9451d6330bb2fd2d0263f947be86e6b0030602c3dbf439030d783ad6a24
MD5 569fdb1eae0089c1fb128b9310b53e7e
SHA1 7d4b10a89752f8ab16af55649f25fdd9e56a049d
SHA512 445f126d5e7aea051808b2f3de7cf43cf245e563a60eb1e0f1e0ae07a7a05d1661c4f54cbb829eb43b5d102400e617db42d535b6b34eef25867ba560e14c8bfa
SSDEEP 49152:luUfb352ZHlYrvKjz+WjO4Li5YrVma37LpvgY1qFshlOjsMzA24qL5Ged6Tz6:ztm+WLLiux5PpvgeqFKOjs2ZJJd6T
TLSH
T1EBC51216E6A500FDD1B791B8D9630806E6727C8A0360DEDF0354EBA61F276E09F3BB51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

147600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpConnect WinHttpCrackUrl WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpQueryDataAvailable

kernel32

LockResource LoadResource FindResourceW MoveFileA GetFileSizeEx WriteProcessMemory WriteFile SetFilePointer WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot GetTempPathA GetFileAttributesA Process32NextW SetFileInformationByHandle MoveFileExA CreateFileA DeleteFileA Process32FirstW CloseHandle SetFileAttributesA GetProcAddress VirtualAllocEx CreateRemoteThread GetLastError FlushFileBuffers SetConsoleTextAttribute SetConsoleTitleA GetStdHandle SetConsoleMode GetConsoleMode GetCurrentProcess GetCurrentThread GetSystemInfo GetThreadContext GlobalMemoryStatusEx GetModuleHandleW GetTickCount64 GetCurrentProcessId QueryPerformanceCounter RemoveVectoredExceptionHandler VirtualProtect AddVectoredExceptionHandler GetVolumeInformationA UnmapViewOfFile LocalFree CreateFileMappingW MapViewOfFile GetComputerNameA MultiByteToWideChar FindClose Sleep SetLastError SizeofResource FindFirstFileExW FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize CreateFileW WriteConsoleW VirtualFreeEx RtlUnwind WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent GetModuleFileNameW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType GetExitCodeProcess CreateProcessW GetFileAttributesExW LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP ReadFile SetFilePointerEx ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc

advapi32

GetUserNameA ConvertStringSecurityDescriptorToSecurityDescriptorW CryptAcquireContextW CryptGenRandom CryptReleaseContext RegQueryValueExA RegCloseKey AllocateAndInitializeSid RegSetValueExA FreeSid CheckTokenMembership RegOpenKeyExA RegOpenKeyExW RegDeleteValueA RegQueryValueExW

Name

.text

Size

299KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.skprot

Size

1024B

Virtual Size

691B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.1MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_569fdb1eae0089c1fb128b9310b53e7e_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

kernel32

advapi32

generic