2026-08-10_4a2f370e4ce4238c443ee2179c40d044_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_4a2f370e4ce4238c443ee2179c40d044_cobalt-strike_icedid_njrat_satacom_stealc
Size 2.0MB
Sample260810-bbfdcssshs
SHA256 04a968b4e43d0c4248721abb2acf744f6f149cf0e92900793e9f59bfa7b3a3b9
MD5 4a2f370e4ce4238c443ee2179c40d044
SHA1 e899361e9478146e38b4b60f8d2896f2a0a7f5ff
SHA512 dfdbf601330b5638d3380635845d52f9133336baef23279a6dbef6dfa22a49742be39ce4457cd8167bd386a17abe968df3c097aca5614ff5ec73b61cc15a69fc
SSDEEP 49152:XdBXCamNvBrT/0hMPqR9U4oHApYpmgfVB60wLEvEz3Fs:fXUqvU4oKYQgfVALkx
TLSH
T1CBA5AF22EA5401ACD1B6D2F4EE275C03E672784A07356DDF03D0A9671F166E84B7FE22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_4a2f370e4ce4238c443ee2179c40d044_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-10_4a2f370e4ce4238c443ee2179c40d044_cobalt-strike_icedid_njrat_satacom_stealc

.exe 2.0MB

2026-08-10_4a2f370e4ce4238c443ee2179c40d044_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 3d3af0fb9f66b2c14334ea43bccf15d9
SHA256 04a968b4e43d0c4248721abb2acf744f6f149cf0e92900793e9f59bfa7b3a3b9
MD5 4a2f370e4ce4238c443ee2179c40d044
SHA1 e899361e9478146e38b4b60f8d2896f2a0a7f5ff
SHA512 dfdbf601330b5638d3380635845d52f9133336baef23279a6dbef6dfa22a49742be39ce4457cd8167bd386a17abe968df3c097aca5614ff5ec73b61cc15a69fc
SSDEEP 49152:XdBXCamNvBrT/0hMPqR9U4oHApYpmgfVB60wLEvEz3Fs:fXUqvU4oKYQgfVALkx
TLSH
T1CBA5AF22EA5401ACD1B6D2F4EE275C03E672784A07356DDF03D0A9671F166E84B7FE22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing combination of virtualization drivers
Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

689152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage GetShellWindow wsprintfA IsWindow GetIconInfo DrawIconEx LoadImageW DestroyIcon LoadIconW LoadCursorA GetCursorPos MessageBoxW GetWindowRect GetClientRect SetWindowRgn EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow GetForegroundWindow GetWindowThreadProcessId GetSystemMetrics KillTimer SetTimer MsgWaitForMultipleObjects ReleaseCapture SetCapture IsClipboardFormatAvailable EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsWindowVisible SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW WaitMessage PostMessageW PeekMessageW DispatchMessageW UpdateWindow

gdi32

SelectObject GetStockObject DeleteObject CreateDIBSection CreateRoundRectRgn CreateEllipticRgn CreateCompatibleDC BitBlt GetObjectW DeleteDC

gdiplus

GdipAlloc GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipCreateStringFormat GdipMeasureString GdipDrawString GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipRestoreGraphics GdipSaveGraphics GdipGetClip GdipResetClip GdipSetClipRegion GdipSetClipPath GdipSetClipRectI GdipSetClipRect GdipDrawImageRectRect GdipDrawImageRectI GdipDrawImageRect GdipFillPath GdipFillEllipse GdipFillRectangleI GdipFillRectangle GdipGraphicsClear GdipDrawPath GdipDrawEllipse GdipDrawLine GdipResetWorldTransform GdipSetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipSetSmoothingMode GdipSetCompositingQuality GdipSetCompositingMode GdipReleaseDC GdipGetDC GdipDeleteGraphics GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdipLoadImageFromFile GdipLoadImageFromStream GdipSetPenColor GdipSetPenEndCap GdipSetPenStartCap GdipSetPenWidth GdipDeletePen GdipCreatePen1 GdipSetSolidFillColor GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDeleteRegion GdipCreateRegion GdipScaleMatrix GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix GdipAddPathEllipse GdipAddPathRectangle GdipAddPathArc GdipClosePathFigure GdipResetPath GdipDeletePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipFree

shell32

ShellExecuteW SHGetFolderPathW

advapi32

OpenServiceA OpenSCManagerA CloseServiceHandle RegQueryValueExA RegOpenKeyExA GetTokenInformation OpenProcessToken GetUserNameA RegOpenKeyExW RegSetValueExW RegQueryValueExW RegCreateKeyExW RegCloseKey

dwmapi

DwmFlush DwmSetWindowAttribute

winmm

timeEndPeriod timeBeginPeriod

winhttp

WinHttpQueryHeaders WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpWebSocketReceive WinHttpWebSocketCompleteUpgrade WinHttpWebSocketSend

wininet

InternetOpenA InternetCloseHandle InternetOpenUrlA HttpQueryInfoA InternetGetConnectedState

bcrypt

BCryptGenRandom BCryptDeriveKey BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptSetProperty BCryptGenerateSymmetricKey BCryptSecretAgreement BCryptEncrypt BCryptDecrypt BCryptExportKey BCryptImportKeyPair BCryptDestroyKey BCryptDestroySecret BCryptGenerateKeyPair BCryptFinalizeKeyPair

crypt32

CryptStringToBinaryA CryptBinaryToStringA

iphlpapi

GetAdaptersInfo

ws2_32

bind freeaddrinfo getaddrinfo WSAGetLastError getsockopt ioctlsocket connect inet_pton WSACleanup WSAStartup socket setsockopt send select recv listen htons closesocket accept

ole32

CreateStreamOnHGlobal

comdlg32

GetOpenFileNameW

kernel32

WaitForSingleObject GetExitCodeProcess SetLastError GetLastError CloseHandle WriteFile SetFileAttributesW ReadFile CreateProcessW GetSystemDirectoryW CopyFileW MoveFileW MultiByteToWideChar WideCharToMultiByte GetSystemTimeAsFileTime WriteConsoleW GetFileSizeEx GetFileAttributesExW GetFileAttributesW DeleteFileW CreateFileW CreateDirectoryW GlobalFree GlobalLock GlobalUnlock GlobalAlloc FindResourceW ReadConsoleW HeapSize GetConsoleMode GetConsoleOutputCP SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindFirstFileExW HeapReAlloc GetOEMCP GetACP IsValidCodePage GetFileType EnumSystemLocalesW GetUserDefaultLCID LoadResource SizeofResource LCMapStringW CompareStringW LoadLibraryExW VirtualProtect UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetProcAddress ExitProcess GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetEnvironmentVariableW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WakeAllConditionVariable SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLogicalProcessorInformationEx GetExitCodeThread GetCurrentThreadId GlobalMemoryStatusEx RemoveDirectoryW GetTempPathW GetLocaleInfoW LockResource IsDebuggerPresent CheckRemoteDebuggerPresent Sleep GetCurrentProcess GetTickCount64 FindClose FindFirstFileW FindNextFileW QueryPerformanceCounter QueryPerformanceFrequency IsValidLocale WaitForSingleObjectEx DeviceIoControl GetTempPathA GetFileAttributesA Process32Next Process32First GetComputerNameA UpdateProcThreadAttribute DeleteProcThreadAttributeList InitializeProcThreadAttributeList CreateProcessA GetProcessHeap HeapFree HeapAlloc GetVolumeInformationA SetFilePointerEx SetEndOfFile CreateFileA SetEnvironmentVariableW GetLocalTime GetSystemInfo SetHandleInformation Process32NextW Process32FirstW CreateToolhelp32Snapshot GetModuleFileNameW TerminateProcess FlushFileBuffers IsWow64Process GetNativeSystemInfo CreatePipe GetEnvironmentVariableA MoveFileExW OpenProcess GetCurrentProcessId GetModuleHandleW

Name

.text

Size

855KB

Virtual Size

854KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

189KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

950KB

Virtual Size

949KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_4a2f370e4ce4238c443ee2179c40d044_cobalt-strike_icedid_njrat_satacom_stealc

user32

gdi32

gdiplus

shell32

advapi32

dwmapi

winmm

winhttp

wininet

bcrypt

crypt32

iphlpapi

ws2_32

ole32

comdlg32

kernel32

generic