2026-08-08_eda9f946a4e7f87492020104400fc986_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_eda9f946a4e7f87492020104400fc986_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.9MB
Sample260808-xccjrack3y
SHA256 4fb64d51b346538c3f8007ea9e4cad967da5881809235df8bf7979a1e91cd44f
MD5 eda9f946a4e7f87492020104400fc986
SHA1 c33300c24d1714c9f4780601863ea6f50bc82362
SHA512 1eafd9c67716bf09404d1dd00470ec8880cb4ff6ecb513680ac73e09d2b9a184adf79cb05a78fc84f4a8c6a8fae7eddf0737f065a4474b7d0c9c06a95052f259
SSDEEP 24576:1nkjsCMMYYic3yiBiVfhlsxSGn5jSZLKErPDLTvV7Z2KnRpHFNcJFGnD:1nhPYicii05sxh5juKEL/T3njg7G
TLSH
T1F495AE47F2A785EDD32B927CC662630BE6F4B415433587CB23904A53AF67AD08EB6311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_eda9f946a4e7f87492020104400fc986_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-08_eda9f946a4e7f87492020104400fc986_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.9MB

2026-08-08_eda9f946a4e7f87492020104400fc986_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH e8df03a329e02372d435b3ef1373627b
SHA256 4fb64d51b346538c3f8007ea9e4cad967da5881809235df8bf7979a1e91cd44f
MD5 eda9f946a4e7f87492020104400fc986
SHA1 c33300c24d1714c9f4780601863ea6f50bc82362
SHA512 1eafd9c67716bf09404d1dd00470ec8880cb4ff6ecb513680ac73e09d2b9a184adf79cb05a78fc84f4a8c6a8fae7eddf0737f065a4474b7d0c9c06a95052f259
SSDEEP 24576:1nkjsCMMYYic3yiBiVfhlsxSGn5jSZLKErPDLTvV7Z2KnRpHFNcJFGnD:1nhPYicii05sxh5juKEL/T3njg7G
TLSH
T1F495AE47F2A785EDD32B927CC662630BE6F4B415433587CB23904A53AF67AD08EB6311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

841664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

winhttp

WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpReceiveResponse WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpSendRequest WinHttpQueryDataAvailable

user32

EndPaint BeginPaint GetKeyState GetMessageExtraInfo GetCapture TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture GetWindowLongW SetCursor IsWindowUnicode ReleaseCapture SetCursorPos UpdateWindow SystemParametersInfoW PostQuitMessage GetClientRect SetWindowLongW TranslateMessage EnumWindows PeekMessageW ClientToScreen GetMonitorInfoW GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData MapVirtualKeyW GetKeyNameTextA DispatchMessageW GetWindowThreadProcessId DefWindowProcW PostMessageW MonitorFromPoint DestroyWindow IsWindowVisible SetWindowPos CreateWindowExW ScreenToClient UnregisterClassW RegisterClassExW ShowWindow GetAsyncKeyState

gdi32

GetStockObject

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

ntdll

RtlUnwindEx RtlPcToFileHeader RtlUnwind RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry

kernel32

GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent TerminateProcess SetStdHandle GetCommandLineA IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException GetOEMCP FindClose FindFirstFileExW FindNextFileW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle HeapSize WriteConsoleW ExitProcess GlobalAlloc InitializeCriticalSectionEx LeaveCriticalSection SetThreadPriority GetTickCount64 GetCurrentThread GetModuleHandleW CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle GetEnvironmentVariableA GetLastError CreateDirectoryA GetModuleFileNameA SetConsoleTitleA OutputDebugStringA GetCurrentThreadId AttachConsole FreeConsole GetConsoleWindow AllocConsole ReadFile GetFileSizeEx WriteFile GetModuleFileNameW CreateFileW MultiByteToWideChar DeleteFileW SetFilePointerEx GetCurrentProcessId CreateProcessW GetVolumeInformationA GetWindowsDirectoryA GetVolumePathNameA GetComputerNameA DeviceIoControl GetProcAddress GetCurrentProcess SetEndOfFile GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter CreateFileA HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep WaitForSingleObjectEx GetExitCodeThread WakeAllConditionVariable EnterCriticalSection

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

Name

.text

Size

1014KB

Virtual Size

1014KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

301KB

Virtual Size

300KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

466KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_eda9f946a4e7f87492020104400fc986_cobalt-strike_icedid_njrat_satacom_stealc

d3d11

d3dcompiler_43

winhttp

user32

gdi32

advapi32

ntdll

kernel32

imm32

generic