2026-08-10_0423666413d7acc55308d1f31179ebef_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_0423666413d7acc55308d1f31179ebef_cobalt-strike_icedid_njrat_ryuk_satacom_stealc
Size 7.2MB
Sample260810-m1zdbaff46
SHA256 4155736aa0a1fff860ab7296f19a8b7319c1bf0daa15f2a6ac2a1b2617ddc03d
MD5 0423666413d7acc55308d1f31179ebef
SHA1 d9d92a74566d2c4175f9ae6949df658a5755963c
SHA512 92c72a209909557b4bf1bba2346273e722b334404e47242df22460987000c7b7e2400675b39859ea65f0a76895fb88985356f8df3e11981da6defbd464cac832
SSDEEP 98304:YbISB5v/OAv+ZuP/W873FfIiUw2A7Ygonbw7K:YbISP3O8+Yf3FbKALEs7K
TLSH
T13E76AE47F242A0FCC45AC4749B47E77766257C8A0F2169DB62D46A3A3EB27E00F39709
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_0423666413d7acc55308d1f31179ebef_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

File Explorer

2026-08-10_0423666413d7acc55308d1f31179ebef_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

.exe 7.2MB

2026-08-10_0423666413d7acc55308d1f31179ebef_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

IMPHASH bff3ae5628198705cf99016e7928d641
SHA256 4155736aa0a1fff860ab7296f19a8b7319c1bf0daa15f2a6ac2a1b2617ddc03d
MD5 0423666413d7acc55308d1f31179ebef
SHA1 d9d92a74566d2c4175f9ae6949df658a5755963c
SHA512 92c72a209909557b4bf1bba2346273e722b334404e47242df22460987000c7b7e2400675b39859ea65f0a76895fb88985356f8df3e11981da6defbd464cac832
SSDEEP 98304:YbISB5v/OAv+ZuP/W873FfIiUw2A7Ygonbw7K:YbISP3O8+Yf3FbKALEs7K
TLSH
T13E76AE47F242A0FCC45AC4749B47E77766257C8A0F2169DB62D46A3A3EB27E00F39709
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3009424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

phase-roblox.pdb

kernel32

AcquireSRWLockExclusive AllocConsole CancelWaitableTimer CloseHandle CompareStringW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateRemoteThread CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW CreateWaitableTimerW DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableA GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocaleInfoA GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTickCount64 GetTimeFormatW GetTimeZoneInformation GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage K32GetModuleBaseNameW LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockResource MapViewOfFile Module32First Module32FirstW Module32Next Module32NextW MultiByteToWideChar OpenEventW OpenFileMappingW OpenProcess OutputDebugStringA PeekNamedPipe Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer SizeofResource Sleep SleepConditionVariableSRW SwitchToThread SystemTimeToTzSpecificLocalTime TerminateProcess UnhandledExceptionFilter UnmapViewOfFile VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQueryEx WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

user32

ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageA EmptyClipboard EnumWindows EqualRect FindWindowA GetAsyncKeyState GetCapture GetClientRect GetClipboardData GetCursorInfo GetCursorPos GetForegroundWindow GetKeyNameTextA GetKeyState GetKeyboardLayout GetMessageExtraInfo GetMonitorInfoW GetRawInputData GetSystemMetrics GetWindowRect GetWindowTextW GetWindowThreadProcessId IsWindow IsWindowUnicode IsWindowVisible LoadCursorA MapVirtualKeyA MessageBoxA MessageBoxW MonitorFromWindow OpenClipboard PeekMessageA PostQuitMessage RegisterClassExW RegisterRawInputDevices ReleaseCapture ScreenToClient SendInput SetCapture SetClipboardData SetCursor SetCursorPos SetForegroundWindow SetLayeredWindowAttributes SetWindowDisplayAffinity SetWindowLongPtrA SetWindowPos ShowWindow TrackMouseEvent TranslateMessage UpdateWindow

shell32

ShellExecuteW

d3dcompiler_47

D3DCompile

ntdll

NtReadVirtualMemory NtWriteVirtualMemory RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken

d3d11

D3D11CreateDevice D3D11CreateDeviceAndSwapChain

wintrust

WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrust

crypt32

CertGetNameStringW CryptUnprotectData

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

wininet

HttpQueryInfoA InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile InternetSetOptionA

ole32

CoCreateInstance CoInitializeEx

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

shlwapi

StrStrIW

winmm

PlaySoundA timeBeginPeriod timeEndPeriod waveOutSetVolume

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.9MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

433B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

130KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_0423666413d7acc55308d1f31179ebef_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

kernel32

user32

shell32

d3dcompiler_47

ntdll

advapi32

d3d11

wintrust

crypt32

dwmapi

winhttp

wininet

ole32

imm32

shlwapi

winmm

bcrypt

generic