2026-08-12_a4164b911b1773e34dc0c59dfcc6a6e4_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_a4164b911b1773e34dc0c59dfcc6a6e4_cobalt-strike_icedid_njrat_satacom_stealc
Size 14.9MB
Sample260812-e35dcayejh
SHA256 d475802b21f6a4d17416c5dfe05e0e1b2ab01c1cb75f51f7a9879a3c756de282
MD5 a4164b911b1773e34dc0c59dfcc6a6e4
SHA1 84294bfaf5c970c04a9fa0addb325a750843a38d
SHA512 bae0f3d2f9c695ad41bea8c0db96f11064472e90b34baab782ea54dd741846a38b9e74a00e93b4ff6dfdc052653a68f0b1abffd48be05197a3aca0a5448d519a
SSDEEP 393216:l1bsrnloIBp+UjATGsDHQl4opVnUk8Qu3AADefzrBcteL4sXRp3em:l1e1BP4NQyopVnDu3NefzdUsBQm
TLSH
T1E8F63369AA8572F9E4CA55799DC7268FF75C30E643B019CF2A5C31CA2E13BC44B39306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_a4164b911b1773e34dc0c59dfcc6a6e4_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-12_a4164b911b1773e34dc0c59dfcc6a6e4_cobalt-strike_icedid_njrat_satacom_stealc

.exe 14.9MB

2026-08-12_a4164b911b1773e34dc0c59dfcc6a6e4_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 85c37a99e449e7f2f24e64fd1fe56db7
SHA256 d475802b21f6a4d17416c5dfe05e0e1b2ab01c1cb75f51f7a9879a3c756de282
MD5 a4164b911b1773e34dc0c59dfcc6a6e4
SHA1 84294bfaf5c970c04a9fa0addb325a750843a38d
SHA512 bae0f3d2f9c695ad41bea8c0db96f11064472e90b34baab782ea54dd741846a38b9e74a00e93b4ff6dfdc052653a68f0b1abffd48be05197a3aca0a5448d519a
SSDEEP 393216:l1bsrnloIBp+UjATGsDHQl4opVnUk8Qu3AADefzrBcteL4sXRp3em:l1e1BP4NQyopVnDu3NefzdUsBQm
TLSH
T1E8F63369AA8572F9E4CA55799DC7268FF75C30E643B019CF2A5C31CA2E13BC44B39306
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

59168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetStdHandle WriteFile OutputDebugStringA GetModuleFileNameW GetTempPathW CreateMutexW CreateFileW GetModuleHandleA Sleep GetLastError FillConsoleOutputCharacterW GetCurrentThread LockResource DeleteFileW CloseHandle CreateThread LoadResource GetCurrentProcess FillConsoleOutputAttribute GetThreadContext GetProcAddress ExitProcess FreeLibrary GetTempFileNameW SetConsoleCursorPosition SetConsoleTitleW LoadLibraryExW IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent WriteConsoleW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW SetLastError GetConsoleScreenBufferInfo FindResourceW SizeofResource FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetOEMCP GetACP IsValidCodePage SetFilePointerEx GetFileSizeEx ReadFile GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree GetConsoleCP IsProcessorFeaturePresent TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetConsoleMode SetConsoleMode ReadConsoleInputW ReadConsoleW RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetFileType VirtualProtect RtlUnwind

user32

FindWindowW SetWindowsHookExW PostThreadMessageW UnhookWindowsHookEx GetWindowThreadProcessId

advapi32

FreeSid CheckTokenMembership AllocateAndInitializeSid

dbghelp

ImageDirectoryEntryToData

bcrypt

BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptCreateHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptSetProperty BCryptFinishHash

winhttp

WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpConnect WinHttpSendRequest

Name

.text

Size

187KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

14.7MB

Virtual Size

14.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_a4164b911b1773e34dc0c59dfcc6a6e4_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

dbghelp

bcrypt

winhttp

generic