2026-08-12_65c744e6b4eb76bcb96e13f4111a896e_cobalt-strike_icedid_satacom

General

Target
2026-08-12_65c744e6b4eb76bcb96e13f4111a896e_cobalt-strike_icedid_satacom
Size 366KB
Sample260813-hb9erstemg
SHA256 2304bcc6dc3ee6ef051fe58e57530792851d4c9a3b121690b832a8abf034e021
MD5 65c744e6b4eb76bcb96e13f4111a896e
SHA1 482e9ccf4bf09b9f26814e4af06876fc89bd3019
SHA512 6998ab67a5a9ae74c94281553bcfbc22e526fbba2d72931a5264e6f7b43141b5ac363ff14a85aab25453491c1d880b2ef470a9865012d9287142a9e24f2767e9
SSDEEP 3072:3AHueGqAGSQsfhnxMWFGIu0dC+b1k/FhQ+w3N:Fq1oV/FGnRG1GcN
TLSH
T121841797A2D421E8EC669B7880720D099777BC753F30EBEF466471652F332D08D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_65c744e6b4eb76bcb96e13f4111a896e_cobalt-strike_icedid_satacom

File Explorer

2026-08-12_65c744e6b4eb76bcb96e13f4111a896e_cobalt-strike_icedid_satacom

.exe 366KB

2026-08-12_65c744e6b4eb76bcb96e13f4111a896e_cobalt-strike_icedid_satacom

IMPHASH 7184e86326ab993d62ffe5087563b72b
SHA256 2304bcc6dc3ee6ef051fe58e57530792851d4c9a3b121690b832a8abf034e021
MD5 65c744e6b4eb76bcb96e13f4111a896e
SHA1 482e9ccf4bf09b9f26814e4af06876fc89bd3019
SHA512 6998ab67a5a9ae74c94281553bcfbc22e526fbba2d72931a5264e6f7b43141b5ac363ff14a85aab25453491c1d880b2ef470a9865012d9287142a9e24f2767e9
SSDEEP 3072:3AHueGqAGSQsfhnxMWFGIu0dC+b1k/FhQ+w3N:Fq1oV/FGnRG1GcN
TLSH
T121841797A2D421E8EC669B7880720D099777BC753F30EBEF466471652F332D08D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

wsprintfA

kernel32

IsDebuggerPresent WriteConsoleW GetTempPathA CloseHandle Sleep CreateProcessA FreeLibrary GetProcAddress LoadLibraryA CopyFileA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW CreateFileW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Name

.text

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

264KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_65c744e6b4eb76bcb96e13f4111a896e_cobalt-strike_icedid_satacom

user32

kernel32

generic