2026-08-14_3774833581272c9ca0074fe7ce773a64_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_3774833581272c9ca0074fe7ce773a64_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.4MB
Sample260814-fd4k7afc76
SHA256 03ad93fa38f724b2870f02e9ab25dc39199e666ce75a1d3e87fb073ec27a5a80
MD5 3774833581272c9ca0074fe7ce773a64
SHA1 81076b07a19f81e7d5c29d2080c2465a070d6c71
SHA512 9bf42d95d0eccf5ed201973206c3c528d564b44dbc1c0955b1d1fef91fde152675572660e8916f6cb835133d19463f49a265532c8620b48e5e98716cabc4565c
SSDEEP 24576:/QlukUUFP90ySMKZugODjjqVW8GK3niOd/gh:YFfFPi1Zu326K3
TLSH
T12C658E07E2B901ECD467C2B8CA165B07EB72B4451334AEDF539089662F23EE15B7B760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_3774833581272c9ca0074fe7ce773a64_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-14_3774833581272c9ca0074fe7ce773a64_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.4MB

2026-08-14_3774833581272c9ca0074fe7ce773a64_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 7d0acfdcb11aaf5c5a41586183adbb92
SHA256 03ad93fa38f724b2870f02e9ab25dc39199e666ce75a1d3e87fb073ec27a5a80
MD5 3774833581272c9ca0074fe7ce773a64
SHA1 81076b07a19f81e7d5c29d2080c2465a070d6c71
SHA512 9bf42d95d0eccf5ed201973206c3c528d564b44dbc1c0955b1d1fef91fde152675572660e8916f6cb835133d19463f49a265532c8620b48e5e98716cabc4565c
SSDEEP 24576:/QlukUUFP90ySMKZugODjjqVW8GK3niOd/gh:YFfFPi1Zu326K3
TLSH
T12C658E07E2B901ECD467C2B8CA165B07EB72B4451334AEDF539089662F23EE15B7B760
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables using Telegram Chat Bot
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1065280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetOpenUrlA HttpQueryInfoA InternetQueryOptionA InternetReadFile InternetGetConnectedState HttpSendRequestA HttpOpenRequestA InternetSetOptionA InternetConnectA InternetCloseHandle InternetOpenA

crypt32

CryptUnprotectData

bcrypt

BCryptDecrypt BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey

iphlpapi

GetAdaptersInfo

shell32

ShellExecuteA ExtractIconExW SHCreateDirectoryExW SHGetFolderPathW ord680 ShellExecuteExW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegSetValueExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW AllocateAndInitializeSid CheckTokenMembership FreeSid GetUserNameA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegOpenKeyExA RegCloseKey

user32

CloseClipboard OpenClipboard CallNextHookEx LoadIconW DestroyIcon ExitWindowsEx PostMessageW UnhookWindowsHookEx SetWindowsHookExW MessageBoxA GetForegroundWindow GetKeyboardState PostThreadMessageW PeekMessageW DispatchMessageW TranslateMessage GetKeyboardLayout ToUnicodeEx ReleaseDC GetDC GetSystemMetrics GetClipboardData SystemParametersInfoW LockWorkStation GetWindowTextA

gdi32

CreateCompatibleDC DeleteDC DeleteObject SelectObject CreateDIBSection GdiFlush BitBlt

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

kernel32

GetStartupInfoW InitializeSListHead SetUnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetConsoleOutputCP GetConsoleMode WriteConsoleW GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW SetLastError FlsAlloc FlsGetValue GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage FlsSetValue FlsFree IsProcessorFeaturePresent FreeLibrary GetModuleHandleExW UnhandledExceptionFilter GetFileType LocalFree GetCommandLineW GetCommandLineA FindFirstFileExW GetACP GetOEMCP SetFilePointerEx RaiseException SetFileAttributesW CloseHandle GetLastError CreateMutexA Sleep ExitProcess CreateThread GetModuleFileNameW LoadLibraryW CopyFileW CreateFileW IsDebuggerPresent GetCurrentProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount64 CreateFileMappingW MapViewOfFile FlushViewOfFile UnmapViewOfFile GetModuleHandleA GetProcAddress LoadLibraryA CreateToolhelp32Snapshot Process32FirstW Process32NextW DeleteFileW GetFileAttributesW WriteFile WaitForSingleObject GetDiskFreeSpaceExA GetLogicalDrives OpenProcess GlobalUnlock GlobalLock GetComputerNameA GetStdHandle ReadFile SetHandleInformation CreatePipe CreateProcessA FindClose FindFirstFileW FindNextFileW AreFileApisANSI GetDriveTypeA TerminateProcess GetLogicalDriveStringsA K32GetProcessMemoryInfo GetFileSize GetTempPathW MultiByteToWideChar WideCharToMultiByte GetSystemDirectoryW VirtualProtect GetModuleHandleW CreateFileA GetTempPathA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlushFileBuffers GetTickCount QueryPerformanceCounter FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetProcessHeap GetCurrentProcessId LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc HeapReAlloc DeleteFileA WaitForSingleObjectEx OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW HeapSize HeapValidate CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate GetTimeZoneInformation

winmm

waveInOpen waveInClose waveInPrepareHeader waveInUnprepareHeader waveInAddBuffer waveInStart waveInReset waveInStop

comctl32

InitCommonControlsEx ord345

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader RtlVirtualUnwind

Name

eereztts

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

afttoipr

Size

213KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

awljhtzj

Size

19KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ptycngps

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

pvwbhatw

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

orwotpkr

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

hzolceio

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_3774833581272c9ca0074fe7ce773a64_cobalt-strike_icedid_njrat_satacom_stealc

wininet

crypt32

bcrypt

iphlpapi

shell32

advapi32

user32

gdi32

ole32

oleaut32

kernel32

winmm

comctl32

ntdll

generic