2026-08-12_658a50664b141e2514ce68315203f56b_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-08-12_658a50664b141e2514ce68315203f56b_cobalt-strike_icedid_njrat_satacom_stealc
Size 2.6MB
Sample260813-bdngraydpb
SHA256 ed4acb1e8977de87d183e7bfd0d404b577e95d5fe1e82c94910e112fdf47b873
MD5 658a50664b141e2514ce68315203f56b
SHA1 abfab4b8d0c9d2ffa48343ea07909f59e0ece5df
SHA512 2569b17f1274b757aa9e906c731086487efd0683e8563fed67f191d065dec3c18485153cce6f37b55aeacf93aec82d3b1eda51bbe02aa51e7c6c973b927159a1
SSDEEP 49152:TW0S7lupQB12O6YFfSM5NvdkemBRY2iTrKSwNjHiX68uGotSGtWA16wmldVdTfR4:y7lB2OBRDxdkemBRVHNjiXOGISGtW66w
TLSH
T169D52395B39541FDE9B7D23C89950905EB727C6243A2F6CF03609AA63F272E01D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_658a50664b141e2514ce68315203f56b_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-12_658a50664b141e2514ce68315203f56b_cobalt-strike_icedid_njrat_satacom_stealc

.exe 2.6MB

2026-08-12_658a50664b141e2514ce68315203f56b_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH d9b952d24ea80d3c67da92724063b7c7
SHA256 ed4acb1e8977de87d183e7bfd0d404b577e95d5fe1e82c94910e112fdf47b873
MD5 658a50664b141e2514ce68315203f56b
SHA1 abfab4b8d0c9d2ffa48343ea07909f59e0ece5df
SHA512 2569b17f1274b757aa9e906c731086487efd0683e8563fed67f191d065dec3c18485153cce6f37b55aeacf93aec82d3b1eda51bbe02aa51e7c6c973b927159a1
SSDEEP 49152:TW0S7lupQB12O6YFfSM5NvdkemBRY2iTrKSwNjHiX68uGotSGtWA16wmldVdTfR4:y7lB2OBRDxdkemBRVHNjiXOGISGtW66w
TLSH
T169D52395B39541FDE9B7D23C89950905EB727C6243A2F6CF03609AA63F272E01D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

55488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\114\Desktop\Crypt\Total\x64\Release\Total.pdb

kernel32

GetModuleFileNameA SetEndOfFile WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW HeapAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode CloseHandle VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap CreateFileW HeapSize WriteConsoleW RtlUnwind

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext CryptImportKey CryptSetKeyParam CryptDecrypt CryptEncrypt CryptHashData CryptDestroyKey CryptGetHashParam CryptDestroyHash CryptCreateHash

Name

.text

Size

193KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_658a50664b141e2514ce68315203f56b_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

advapi32

generic