2026-08-14_f6966bab4baf67ddad4d53c47f6ffde8_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_f6966bab4baf67ddad4d53c47f6ffde8_cobalt-strike_icedid_njrat_satacom_stealc
Size 726KB
Sample260815-chsspsdc77
SHA256 96caa288e55b9bcd4e8a41528c498afdd78c79f41fae8c788b8513fbf0353a93
MD5 f6966bab4baf67ddad4d53c47f6ffde8
SHA1 1f6d5f10051379cd8b159368f40eda816b8f002c
SHA512 a29ed9d25d938e57761a05214195b0d62d46b13c7516183a40b98156a0f95e7a002870945dbd7ec8d7cd1f8744e96f4238503fd1ac2d491b7f33be4ce4c4f87b
SSDEEP 12288:VwSVUWnIhICncHo4ngyBtAPKSr4SzY0EVjQ1GZYWi:WSuWneICncHo4nj6KSLzYC0ZPi
TLSH
T100F46C45A3E81198F1B3EA76D9B25611EAB27C850B70E5EF03E0489D1F377E0963B712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_f6966bab4baf67ddad4d53c47f6ffde8_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-14_f6966bab4baf67ddad4d53c47f6ffde8_cobalt-strike_icedid_njrat_satacom_stealc

.exe 726KB

2026-08-14_f6966bab4baf67ddad4d53c47f6ffde8_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 9678f9ba0f98fa3ba48b4425a8a89125
SHA256 96caa288e55b9bcd4e8a41528c498afdd78c79f41fae8c788b8513fbf0353a93
MD5 f6966bab4baf67ddad4d53c47f6ffde8
SHA1 1f6d5f10051379cd8b159368f40eda816b8f002c
SHA512 a29ed9d25d938e57761a05214195b0d62d46b13c7516183a40b98156a0f95e7a002870945dbd7ec8d7cd1f8744e96f4238503fd1ac2d491b7f33be4ce4c4f87b
SSDEEP 12288:VwSVUWnIhICncHo4ngyBtAPKSr4SzY0EVjQ1GZYWi:WSuWneICncHo4nj6KSLzYC0ZPi
TLSH
T100F46C45A3E81198F1B3EA76D9B25611EAB27C850B70E5EF03E0489D1F377E0963B712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\INTERNAL\ESP HOOK LOADER (BYTE)\build\hookloader.pdb

kernel32

Sleep GetLastError GetProcAddress GetTempPathW WaitForSingleObject OpenProcess SetFileAttributesW LoadLibraryExW CloseHandle GetConsoleWindow SetConsoleScreenBufferSize GetStdHandle SetConsoleWindowInfo LoadLibraryW SetConsoleTitleW DeleteFileW GetModuleHandleW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter FreeLibrary

user32

SetWindowPos GetWindowLongPtrW SetWindowLongPtrW SetWindowsHookExW GetWindowThreadProcessId ShowWindow FindWindowW UnhookWindowsHookEx PostThreadMessageW

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?good@ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Random_device@std@@YAIXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??7ios_base@std@@QEBA_NXZ

dbghelp

ImageDirectoryEntryToData

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __current_exception_context memmove __std_exception_destroy memcpy _CxxThrowException __C_specific_handler __std_terminate __std_exception_copy memset

api-ms-win-crt-stdio-l1-1-0

fputc __p__commode _set_fmode _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite fgetc fclose fflush

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment _get_initial_wide_environment _initterm _configure_wide_argv _set_app_type _seh_filter_exe _exit system __p___argc __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback exit _initterm_e terminate _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

wcslen strlen

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_f6966bab4baf67ddad4d53c47f6ffde8_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

msvcp140

dbghelp

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

generic