2026-08-09_276417424f881d3d9b71d434b7ec58e3_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_276417424f881d3d9b71d434b7ec58e3_cobalt-strike_icedid_njrat_satacom_stealc
Size 910KB
Sample260809-nbbfmazvgy
SHA256 bd768eb9f4598051d761522d0079a715455339212403de821f4e0eacbbc1eca7
MD5 276417424f881d3d9b71d434b7ec58e3
SHA1 d1fb7a09e3162c6c60c7870e8523b6d0b7f2d2c0
SHA512 3e02fd9e1d5a0d119e46d9beddb50643b6c4dddddfead575471ee3fb7a017f977ee198885554eb42938b1cc7d1e98426d376c1007719d6e9ab89104a16a76f72
SSDEEP 12288:XK0aDRO10Xm+z087tS4BSM15Qo3n2LfUhmAGbYiVnoWvqQ:XQ1W0Xm+z0Ol1io3n27N0iVnoWv
TLSH
T1AD156C42A2E828E8E0769634D7B363D7DB7AB8150730D6CF139005583F3B6E57A76B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_276417424f881d3d9b71d434b7ec58e3_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-09_276417424f881d3d9b71d434b7ec58e3_cobalt-strike_icedid_njrat_satacom_stealc

.exe 910KB

2026-08-09_276417424f881d3d9b71d434b7ec58e3_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 2aa2c737cf17991ee3cb5bc16ccfad84
SHA256 bd768eb9f4598051d761522d0079a715455339212403de821f4e0eacbbc1eca7
MD5 276417424f881d3d9b71d434b7ec58e3
SHA1 d1fb7a09e3162c6c60c7870e8523b6d0b7f2d2c0
SHA512 3e02fd9e1d5a0d119e46d9beddb50643b6c4dddddfead575471ee3fb7a017f977ee198885554eb42938b1cc7d1e98426d376c1007719d6e9ab89104a16a76f72
SSDEEP 12288:XK0aDRO10Xm+z087tS4BSM15Qo3n2LfUhmAGbYiVnoWvqQ:XQ1W0Xm+z0Ol1io3n27N0iVnoWv
TLSH
T1AD156C42A2E828E8E0769634D7B363D7DB7AB8150730D6CF139005583F3B6E57A76B12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

407696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\parat\source\repos\BluntWareGUIExecuter\x64\Release\BluntWareGUIExecuter.pdb

winhttp

WinHttpConnect WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse

d3d11

D3D11CreateDeviceAndSwapChain

ole32

CoCreateInstance CoInitializeEx CoUninitialize

kernel32

GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx GetConsoleOutputCP GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter GetModuleFileNameW GetFileAttributesW Sleep GetFileAttributesA WideCharToMultiByte OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock CreateDirectoryW WriteProcessMemory GetEnvironmentVariableW GetTempPathW GetVolumeInformationA WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Process32NextW K32GetModuleBaseNameW DeleteFileW Process32FirstW CloseHandle VirtualAllocEx ReadProcessMemory GetModuleHandleW CreateRemoteThread K32EnumProcessModules GetCommandLineW RtlPcToFileHeader FlushFileBuffers ReadConsoleW GetConsoleMode SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc OutputDebugStringW UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent WriteFile TerminateProcess ExitProcess GetCurrentProcess ReadFile FreeLibraryAndExitThread ExitThread CreateThread WriteConsoleW GetModuleHandleExW GetFileType GetStdHandle FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle RtlUnwindEx RtlLookupFunctionEntry HeapReAlloc CreateFileW HeapSize SetEndOfFile VirtualFreeEx RtlUnwind ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RaiseException

user32

TrackMouseEvent SetCursorPos GetWindowThreadProcessId IsWindowVisible EnumWindows GetWindowTextW OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DestroyWindow SetWindowRgn CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW TranslateMessage SendMessageA PostQuitMessage UpdateWindow DefWindowProcW GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen ReleaseCapture GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode GetCursorPos

gdi32

CreateRoundRectRgn

shell32

ShellExecuteW

d3dcompiler_47

D3DCompile

urlmon

URLDownloadToFileW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

598KB

Virtual Size

598KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

201KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_276417424f881d3d9b71d434b7ec58e3_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

d3d11

ole32

kernel32

user32

gdi32

shell32

d3dcompiler_47

urlmon

imm32

generic