2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom
Size 1.1MB
Sample260812-tbdtmsdf37
SHA256 b49660b13329938128231255e8df1d7db917392a7cc0825b63d4dd8924e7ce83
MD5 8c6103fe5c15a2a27c3823b68ca30285
SHA1 933179ec6f883b82afdb5df3828e282b933360e0
SHA512 8286fbd124f90b54c5ae138f9f60cac43ea390338b5bc94ee50492d45968d3732dd2b9e2779a8a5bc1496395b54c65b6a40cb92e21bfdde1d514a281f8df978f
SSDEEP 24576:ikERpfKm0y5hDwRav1P7asD5ys7E1iHQFEBJjrJyz8eH:MD0y5hkWP7avUuiwFYVYhH
TLSH
T13D45BF12A7E640E8DC7AC6348A36A622AAB27C015F34A99F5394571E3F73F805F3D705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom

.exe 1.1MB

2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom

IMPHASH b85d0d48e6f4100a1351d5c36a1198ee
SHA256 b49660b13329938128231255e8df1d7db917392a7cc0825b63d4dd8924e7ce83
MD5 8c6103fe5c15a2a27c3823b68ca30285
SHA1 933179ec6f883b82afdb5df3828e282b933360e0
SHA512 8286fbd124f90b54c5ae138f9f60cac43ea390338b5bc94ee50492d45968d3732dd2b9e2779a8a5bc1496395b54c65b6a40cb92e21bfdde1d514a281f8df978f
SSDEEP 24576:ikERpfKm0y5hDwRav1P7asD5ys7E1iHQFEBJjrJyz8eH:MD0y5hkWP7avUuiwFYVYhH
TLSH
T13D45BF12A7E640E8DC7AC6348A36A622AAB27C015F34A99F5394571E3F73F805F3D705
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

417248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

Shell_NotifyIconW DragFinish DragQueryFileA DragAcceptFiles ord71 ShellExecuteA

advapi32

OpenSCManagerA DeleteService ControlService SystemFunction036 GetUserNameW RegSetKeySecurity ConvertSecurityDescriptorToStringSecurityDescriptorA InitializeSecurityDescriptor SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegQueryValueExA RegSetValueExA RegCloseKey RegCreateKeyExA RegSetValueA RegGetKeySecurity OpenServiceA CreateServiceA StartServiceA ChangeServiceConfigA StartServiceCtrlDispatcherA CloseServiceHandle RegOpenKeyA ControlTraceA StartTraceA EnableTraceEx2 OpenTraceA ProcessTrace CloseTrace RegisterServiceCtrlHandlerExA SetServiceStatus

user32

GetClipboardData CloseClipboard MapWindowPoints IsDialogMessageW OpenClipboard BringWindowToTop GetClassNameA GetWindowThreadProcessId LoadImageA EnableWindow SetFocus ShowWindow GetForegroundWindow MessageBoxTimeoutW AttachThreadInput SendMessageW PostMessageW GetDlgItem LoadIconW LoadMenuIndirectW SetTimer CreateDialogIndirectParamW GetSysColor GetSysColorBrush CreateWindowExW SetWindowTextW GetWindowRect ScreenToClient GetClientRect MoveWindow SetForegroundWindow LoadIconA PostQuitMessage GetSubMenu TrackPopupMenu EndDialog SetDlgItemTextW MsgWaitForMultipleObjects PeekMessageW TranslateMessage DispatchMessageW IsDlgButtonChecked CheckDlgButton MessageBoxW SetClassLongPtrW MapVirtualKeyExA GetWindowTextW GetDlgItemTextW DialogBoxIndirectParamW GetWindowLongPtrW SetWindowLongPtrW IsClipboardFormatAvailable

ntdll

RtlCaptureContext RtlVirtualUnwind NtUnmapViewOfSection NtResumeProcess RtlPcToFileHeader NtReadVirtualMemory NtQueryVirtualMemory NtQueryInformationProcess RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlUnwindEx NtSuspendProcess NtTerminateProcess RtlCrc64

gdi32

SetBkColor SetTextColor DeleteObject

oleaut32

SysAllocString SysFreeString

ws2_32

inet_addr getpeername accept listen bind socket getsockname freeaddrinfo getaddrinfo send connect setsockopt WSASocketW WSAStartup WSAEnumProtocolsW WSAPoll recv closesocket WSAEventSelect htons

dbghelp

SymInitialize SymGetSymFromAddr64

ole32

CoCreateInstance CoUninitialize CoInitializeSecurity CoInitializeEx CoAllowSetForegroundWindow CoInitialize

tdh

TdhGetEventInformation

dinput8

DirectInput8Create

version

GetFileVersionInfoW VerQueryValueA

comctl32

InitCommonControlsEx

wininet

HttpOpenRequestA HttpAddRequestHeadersA InternetOpenA InternetConnectA InternetSetOptionA HttpSendRequestA InternetReadFile InternetCloseHandle

kernel32

GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetTimeZoneInformation MoveFileExW OutputDebugStringW ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetCPInfo GetOEMCP GetACP IsValidCodePage GetFileAttributesExW FindFirstFileExW DeleteFileA HeapQueryInformation HeapSize HeapReAlloc HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent ExitProcess WriteConsoleW GetModuleHandleExW GetFileType GetStdHandle IsProcessorFeaturePresent GetCommandLineW GetModuleFileNameW Process32Next EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError QueryFullProcessImageNameW SetEvent DuplicateHandle FindNextFileW GetCommandLineA OpenProcess Process32First CreateToolhelp32Snapshot GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime VirtualQueryEx GlobalUnlock GlobalLock CreateProcessA GetStartupInfoA CreatePipe IsBadWritePtr FreeLibrary Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection GetUserDefaultUILanguage LoadLibraryA GetModuleFileNameA DeviceIoControl LocalFree TerminateProcess SetPriorityClass SetThreadPriority GetCurrentThread GetExitCodeThread CreateRemoteThread WriteProcessMemory K32EnumProcesses GetModuleHandleA K32GetModuleFileNameExA K32EnumProcessModulesEx IsWow64Process2 ReadProcessMemory VirtualFree RaiseException DeleteFileW GetFileSizeEx SignalObjectAndWait ReadFile FindClose FormatMessageA LockFile MultiByteToWideChar VirtualAlloc Sleep QueryPerformanceCounter MapViewOfFile CreateFileA GetFileAttributesA CopyFileA AddVectoredExceptionHandler FlushViewOfFile FlushFileBuffers GetLastError WaitForSingleObject TlsGetValue GetCurrentThreadId ReleaseMutex TlsSetValue GetCurrentProcessId GetSystemInfo UnmapViewOfFile GetCurrentProcess GetOverlappedResult TlsAlloc GetFileSize SetFilePointer SetEndOfFile CreateFileMappingA MapViewOfFileEx CloseHandle GetFileInformationByHandle CreateMutexA OpenMutexA CreateFileW GetModuleHandleW GetProcAddress WriteFile LockFileEx UnlockFile TlsFree CreateEventA CreateThread WideCharToMultiByte CreateDirectoryA CreateDirectoryExA MoveFileA

Name

.text

Size

571KB

Virtual Size

570KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

26.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

438KB

Virtual Size

438KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_8c6103fe5c15a2a27c3823b68ca30285_cobalt-strike_icedid_njrat_satacom

shell32

advapi32

user32

ntdll

gdi32

oleaut32

ws2_32

dbghelp

ole32

tdh

dinput8

version

comctl32

wininet

kernel32

generic