2026-08-14_c403f64271c55799ca8d18762a627a0c_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_c403f64271c55799ca8d18762a627a0c_cobalt-strike_icedid_njrat_satacom_stealc
Size 4.9MB
Sample260814-dtaa6stdph
SHA256 b8d2fff9fa2740f5df036a18a013482ab3fd46b70b27669b1a9d6a9520e878c1
MD5 c403f64271c55799ca8d18762a627a0c
SHA1 0d411f070c4e6b6f8d003df66ccddec22600d3d8
SHA512 f1de75e7e4db3c591e8ca6c01d9ed88872799b5a4396f7f2ade6eb433371d67428c753e77194cef0d93bfd3321686d98f2e85b0b9e5b017751acd49ba6f6df95
SSDEEP 98304:POb8p2D88FTiXXLPUV+sWWs10u/g/dgZ:Gb8ePFerPLWs103
TLSH
T10136233F6A7608EAC8368178C946A5C2DDB2D41ADB43C59787B01A0F5D737D2BA3D360
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_c403f64271c55799ca8d18762a627a0c_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-14_c403f64271c55799ca8d18762a627a0c_cobalt-strike_icedid_njrat_satacom_stealc

.exe 4.9MB

2026-08-14_c403f64271c55799ca8d18762a627a0c_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH d2c40d2d11dc2d19266c62ec9c223d03
SHA256 b8d2fff9fa2740f5df036a18a013482ab3fd46b70b27669b1a9d6a9520e878c1
MD5 c403f64271c55799ca8d18762a627a0c
SHA1 0d411f070c4e6b6f8d003df66ccddec22600d3d8
SHA512 f1de75e7e4db3c591e8ca6c01d9ed88872799b5a4396f7f2ade6eb433371d67428c753e77194cef0d93bfd3321686d98f2e85b0b9e5b017751acd49ba6f6df95
SSDEEP 98304:POb8p2D88FTiXXLPUV+sWWs10u/g/dgZ:Gb8ePFerPLWs103
TLSH
T10136233F6A7608EAC8368178C946A5C2DDB2D41ADB43C59787B01A0F5D737D2BA3D360
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetConsoleCursorInfo SetConsoleWindowInfo GetTempPathW GetFileAttributesW CreateToolhelp32Snapshot GetConsoleMode GetLastError SetConsoleCursorInfo Process32NextW DeleteFileW Process32FirstW SetConsoleMode SetConsoleCP CreateProcessW GetConsoleWindow SetConsoleOutputCP SetConsoleCursorPosition SetConsoleTitleW SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetStdHandle SetConsoleScreenBufferSize CloseHandle GetConsoleScreenBufferInfo GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetConsoleCP IsProcessorFeaturePresent GetModuleFileNameW WriteFile GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP HeapFree HeapAlloc CreateFileW GetNumberOfConsoleInputEvents ReadConsoleInputW PeekConsoleInputA ReadConsoleW WaitForSingleObject GetExitCodeProcess GetFileAttributesExW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile IsValidCodePage GetACP GetOEMCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW RtlUnwind

user32

SetWindowLongW GetWindowLongW SetWindowPos

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

ShellExecuteW ShellExecuteExW

Name

.text

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ot

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.at

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_c403f64271c55799ca8d18762a627a0c_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

generic