2026-08-08_0172b69db4f9b2ad179fa36fae1808d8_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-08-08_0172b69db4f9b2ad179fa36fae1808d8_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.9MB
Sample260808-p27r7ade87
SHA256 74565811831e7ee769d67329f337e97a2f6af31bb26296769441fee55f332013
MD5 0172b69db4f9b2ad179fa36fae1808d8
SHA1 472790e6630a9d5a8a9e12d82cc06a1194cb8a27
SHA512 88518f1ad582b77a77234d135a486befd5ff7ba59e56bde3cc8d8623d5f1ef4e812891e7e5861c03840b940fd97301fb4b83a7b8414bf6e267a98e38ad6b0144
SSDEEP 24576:obxquTnBIZOKIKKgoVpyF2TQwIaFSfCLulIM3lfGlFY4sLvnTAMo+/gv:obIIIOKUfW2TnLulIM3h3VLvncMf/2
TLSH
T1CC950255EA9405FDE1A7E2B8C9A30802D771788A1371EECF03945A571F27AF49E3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_0172b69db4f9b2ad179fa36fae1808d8_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-08_0172b69db4f9b2ad179fa36fae1808d8_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.9MB

2026-08-08_0172b69db4f9b2ad179fa36fae1808d8_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH d66090be25d0c8c05f87dd3ef60bd965
SHA256 74565811831e7ee769d67329f337e97a2f6af31bb26296769441fee55f332013
MD5 0172b69db4f9b2ad179fa36fae1808d8
SHA1 472790e6630a9d5a8a9e12d82cc06a1194cb8a27
SHA512 88518f1ad582b77a77234d135a486befd5ff7ba59e56bde3cc8d8623d5f1ef4e812891e7e5861c03840b940fd97301fb4b83a7b8414bf6e267a98e38ad6b0144
SSDEEP 24576:obxquTnBIZOKIKKgoVpyF2TQwIaFSfCLulIM3lfGlFY4sLvnTAMo+/gv:obIIIOKUfW2TnLulIM3h3VLvncMf/2
TLSH
T1CC950255EA9405FDE1A7E2B8C9A30802D771788A1371EECF03945A571F27AF49E3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

143888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

SetWindowLongPtrW GetWindowLongPtrW SetLayeredWindowAttributes

advapi32

RegOpenKeyExW OpenServiceW OpenSCManagerW ControlService OpenProcessToken GetTokenInformation RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges RegDeleteTreeW

shell32

ShellExecuteExW CommandLineToArgvW

kernel32

HeapSize WriteConsoleW GetFileInformationByHandleEx SetStdHandle GetProcessHeap SetEnvironmentVariableW GetCommandLineW IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle GetLastError GetCurrentProcess GetModuleFileNameW GetModuleHandleW GetProcAddress SizeofResource FindResourceW LocalFree WideCharToMultiByte SetConsoleTitleW GetConsoleWindow GetStdHandle GetConsoleMode SetConsoleMode SetConsoleOutputCP GetConsoleScreenBufferInfo SetConsoleScreenBufferSize SetConsoleWindowInfo SetCurrentConsoleFontEx GetEnvironmentVariableW GetFileAttributesW Sleep TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW LoadLibraryExW FreeLibrary GetSystemDirectoryW LocalAlloc SetLastError FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileAttributesW SetFileInformationByHandle CreateFile2 AreFileApisANSI RtlUnwind MultiByteToWideChar EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead FreeEnvironmentStringsW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetConsoleCP IsProcessorFeaturePresent ExitProcess GetModuleHandleExW WriteFile GetCommandLineA HeapFree HeapAlloc CreateFileW ReadConsoleInputW ReadConsoleW RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetFileType VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP ReadFile GetFileSizeEx SetFilePointerEx IsValidCodePage GetACP GetOEMCP HeapReAlloc GetEnvironmentStringsW

Name

.text

Size

273KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_0172b69db4f9b2ad179fa36fae1808d8_cobalt-strike_icedid_njrat_satacom_stealc

user32

advapi32

shell32

kernel32

generic