2026-08-09_9ec815e1becc0ac79fc36a85edf058f1_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_9ec815e1becc0ac79fc36a85edf058f1_cobalt-strike_icedid_njrat_satacom_stealc
Size 827KB
Sample260809-chnhzsgd28
SHA256 6a32f0303b3ef3f5143f56c066b674cb41d9ea0c8ac7dba3cf89b05bc966e1be
MD5 9ec815e1becc0ac79fc36a85edf058f1
SHA1 01b3e204371f0ad1a4ec82bc5b9fbce8bd6f9f47
SHA512 52a50b6f17307d772e8ec16813f964b37450396c1806def82c80cc3a061368332e232dcbea77f3d96cb08d9540d3d925e406fc389eb0d0240af1e3ff44408222
SSDEEP 12288:1NGG3U3ITEmUbqLELnKw6mW6PVvueRaXOIHv8MHwGOAd4P27i:lAIAmUbqoLKwzW6PVvub+IP1QJX8i
TLSH
T17105F115FBA814F9E1B7C13CC9634606EE717C5A076097CF13A48AA62F276D09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_9ec815e1becc0ac79fc36a85edf058f1_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-09_9ec815e1becc0ac79fc36a85edf058f1_cobalt-strike_icedid_njrat_satacom_stealc

.exe 827KB

2026-08-09_9ec815e1becc0ac79fc36a85edf058f1_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 67a7936e5cfe85c59e22209580503115
SHA256 6a32f0303b3ef3f5143f56c066b674cb41d9ea0c8ac7dba3cf89b05bc966e1be
MD5 9ec815e1becc0ac79fc36a85edf058f1
SHA1 01b3e204371f0ad1a4ec82bc5b9fbce8bd6f9f47
SHA512 52a50b6f17307d772e8ec16813f964b37450396c1806def82c80cc3a061368332e232dcbea77f3d96cb08d9540d3d925e406fc389eb0d0240af1e3ff44408222
SSDEEP 12288:1NGG3U3ITEmUbqLELnKw6mW6PVvueRaXOIHv8MHwGOAd4P27i:lAIAmUbqoLKwzW6PVvub+IP1QJX8i
TLSH
T17105F115FBA814F9E1B7C13CC9634606EE717C5A076097CF13A48AA62F276D09E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

83904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage GetClassNameW SetLayeredWindowAttributes EnumWindows GetForegroundWindow PeekMessageW GetLayeredWindowAttributes DispatchMessageW IsWindow ShowWindow GetWindowLongPtrW SetWindowTextW CreateWindowExW SetWindowLongPtrW SetWindowPos IsWindowVisible GetCursorInfo ClientToScreen DrawIconEx GetWindowRect GetDC DrawIcon PrintWindow GetDesktopWindow ReleaseDC GetMessageW DefWindowProcW FillRect GetSystemMetrics RegisterClassExW LoadCursorW GetClientRect DrawTextW PostQuitMessage UpdateWindow BeginPaint EndPaint GetWindowThreadProcessId PostMessageW GetWindow DestroyWindow GetWindowTextW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC GetStockObject DeleteDC SelectObject CreateFontW SetTextColor SetBkMode DeleteObject CreateSolidBrush

gdiplus

GdipCreateBitmapFromHBITMAP GdipFree GdipCloneImage GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToStream GdiplusShutdown GdipDisposeImage GdiplusStartup GdipAlloc

bcrypt

BCryptGenRandom

shell32

CommandLineToArgvW SHGetFolderPathW ShellExecuteW

comctl32

InitCommonControlsEx

uxtheme

IsThemeActive

advapi32

RegQueryValueExW GetUserNameW RegCloseKey RegOpenKeyExW

kernel32

IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW HeapAlloc GetUserDefaultLCID GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext EnumSystemLocalesW ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW HeapFree GetCommandLineA GetStdHandle GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError GetEnvironmentStringsW RtlUnwindEx RtlLookupFunctionEntry FreeEnvironmentStringsW InitializeSListHead GetSystemTimeAsFileTime GetProcessHeap SetStdHandle HeapSize WriteConsoleW CreateDirectoryW ReadFile GetFileSizeEx EnterCriticalSection GetCommandLineW WriteFile GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW ReleaseMutex SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetLastError Process32NextW DeleteFileW Process32FirstW CloseHandle CreateThread SwitchToThread GetProcAddress LocalFree GetFileSize DeleteCriticalSection ExitProcess CreateProcessW GetModuleHandleW RtlUnwind GetTickCount GetFileTime GetExitCodeProcess FormatMessageA OutputDebugStringA SetHandleInformation TerminateProcess CreatePipe PeekNamedPipe CreateEventW GetTickCount64 SetEvent GetDiskFreeSpaceExW GetComputerNameW GlobalMemoryStatusEx RaiseException GetSystemInfo VirtualProtect VirtualQuery FreeLibrary LoadLibraryExA GetCurrentProcessId SetEndOfFile RtlPcToFileHeader WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WaitForSingleObjectEx GetExitCodeThread InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW

crypt32

CryptProtectData CryptUnprotectData

Name

.text

Size

231KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

97KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_9ec815e1becc0ac79fc36a85edf058f1_cobalt-strike_icedid_njrat_satacom_stealc

user32

gdi32

gdiplus

bcrypt

shell32

comctl32

uxtheme

advapi32

kernel32

crypt32

generic