2026-08-11_c2060ee63bbc66a2f3dadb3bb623847b_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_c2060ee63bbc66a2f3dadb3bb623847b_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.7MB
Sample260811-cwspvstdkb
SHA256 ba40f6a687606764172f4e80fb1d87fb3574a62bdb24dac95b761ea423f89493
MD5 c2060ee63bbc66a2f3dadb3bb623847b
SHA1 2bb952265c8f7b3ce861e6bf1c697c2234a0d838
SHA512 df0b15b1060d986775557b7ac8c24cf20e91236c6f2b39eaec397668b8b1c39ad4f64459817577ea689c0668c7ea05f5df96580fecb172c14dc75f4b2b9dd9ce
SSDEEP 49152:TjJ0BBrrd5rWlaTezyqOiOQ9Xr7jFphld0f:Td0l5iIS8Gld0
TLSH
T123858E03B2DA50FCD05AF6B49656962B97367C4607309DEF13802A282FBE7E44F35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_c2060ee63bbc66a2f3dadb3bb623847b_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-11_c2060ee63bbc66a2f3dadb3bb623847b_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.7MB

2026-08-11_c2060ee63bbc66a2f3dadb3bb623847b_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 3b8ae009f5318ac65759f8b1617553a7
SHA256 ba40f6a687606764172f4e80fb1d87fb3574a62bdb24dac95b761ea423f89493
MD5 c2060ee63bbc66a2f3dadb3bb623847b
SHA1 2bb952265c8f7b3ce861e6bf1c697c2234a0d838
SHA512 df0b15b1060d986775557b7ac8c24cf20e91236c6f2b39eaec397668b8b1c39ad4f64459817577ea689c0668c7ea05f5df96580fecb172c14dc75f4b2b9dd9ce
SSDEEP 49152:TjJ0BBrrd5rWlaTezyqOiOQ9Xr7jFphld0f:Td0l5iIS8Gld0
TLSH
T123858E03B2DA50FCD05AF6B49656962B97367C4607309DEF13802A282FBE7E44F35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

966768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

glfw3

glfwInit glfwSwapInterval glfwSetWindowFocusCallback glfwGetWin32Window glfwMakeContextCurrent glfwCreateWindow glfwWindowHint glfwTerminate glfwSetCursorEnterCallback glfwGetClipboardString glfwSetClipboardString glfwSetCursor glfwGetGamepadState glfwSetInputMode glfwGetInputMode glfwGetCursorPos glfwSetCursorPos glfwGetWindowAttrib glfwGetTime glfwGetWindowSize glfwDestroyCursor glfwCreateStandardCursor glfwSetMonitorCallback glfwSetCharCallback glfwSetKeyCallback glfwSetScrollCallback glfwSetMouseButtonCallback glfwSetCursorPosCallback glfwGetError glfwGetKeyName glfwSetErrorCallback glfwGetKey glfwSetWindowSize glfwDestroyWindow glfwGetFramebufferSize glfwPollEvents glfwWindowShouldClose glfwSwapBuffers

opengl32

glGenTextures glBindTexture glTexImage2D glTexParameteri glViewport glClearColor glClear glTexSubImage2D glDeleteTextures

onnxruntime

ord1 ord4

xinput1_4

ord2

sdl2

SDL_SetMainReady SDL_SetHint SDL_Init SDL_Quit SDL_GameControllerClose SDL_PollEvent SDL_GameControllerGetJoystick SDL_JoystickInstanceID SDL_NumJoysticks SDL_IsGameController SDL_GameControllerNameForIndex SDL_GameControllerOpen SDL_GameControllerName SDL_Delay

user32

GetClipboardData LoadImageA EmptyClipboard SetClipboardData SetPropA OpenClipboard SendMessageA MessageBoxA CloseClipboard GetWindowLongPtrW CallWindowProcW GetMessageExtraInfo GetPropA SetWindowLongPtrW

shell32

ShellExecuteW SHGetFolderPathA

advapi32

LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken

winhttp

WinHttpOpen WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest WinHttpSetOption WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryOption WinHttpReadData WinHttpQueryDataAvailable

bcrypt

BCryptGenRandom BCryptCreateHash BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptHashData BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptOpenAlgorithmProvider

crypt32

CertFreeCertificateContext

winmm

timeEndPeriod timeBeginPeriod

d3d12

ord101

ole32

CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeEx

oleaut32

VariantClear SysFreeString SysAllocString

kernel32

GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FlushFileBuffers GetFileSizeEx GetConsoleOutputCP LCMapStringW CompareStringW LoadLibraryExW VirtualProtect ReadConsoleW GetConsoleMode HeapReAlloc HeapAlloc OutputDebugStringW SetFilePointerEx UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext HeapFree IsProcessorFeaturePresent GetCommandLineW GetCommandLineA TerminateProcess WriteFile FreeLibraryAndExitThread ExitThread CreateThread ReadFile WriteConsoleW GetModuleHandleExW GetModuleFileNameW GetFileType GetStdHandle DeleteCriticalSection GetEnvironmentStringsW LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetCPInfo FreeEnvironmentStringsW RtlUnwind SetEnvironmentVariableW SetStdHandle WideCharToMultiByte GetStringTypeW GetProcessHeap CreateFileW HeapSize QueryPerformanceFrequency GetExitCodeThread WaitForSingleObjectEx LocalFree GetLastError GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive OutputDebugStringA GlobalFree GlobalAlloc GlobalUnlock GlobalLock SetEndOfFile InitializeCriticalSectionEx GetVolumeInformationA GetLogicalDrives FindClose FindNextFileA FindFirstFileA GetTempPathA SetThreadExecutionState DeleteFileA MultiByteToWideChar GetModuleFileNameA ExitProcess Sleep FreeLibrary GetProcAddress LoadLibraryA GetFileAttributesA GetModuleHandleA CloseHandle CheckRemoteDebuggerPresent GetCurrentProcess SetPriorityClass IsDebuggerPresent GetComputerNameA

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

251KB

Virtual Size

252KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

51KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

264KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_c2060ee63bbc66a2f3dadb3bb623847b_cobalt-strike_icedid_njrat_satacom_stealc

glfw3

opengl32

onnxruntime

xinput1_4

sdl2

user32

shell32

advapi32

winhttp

bcrypt

crypt32

winmm

d3d12

ole32

oleaut32

kernel32

imm32

generic