2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.6MB
Sample260816-e9sm5adk3x
SHA256 cf468466c6aec4130488e2bb87dc83fdea0ab2abd606cb49bf918bdfd33941fc
MD5 4fb0b3996d6b58eb17b133528800d134
SHA1 094802ad7f372ae6a670f37c77d04000dcc92986
SHA512 56ca8cf62b339830d92f076a5d5a855d873c1a2138d5ac2e13c572cba940a7ebabe116ca07e793c854fd3f786ae5ca4b33742a633894e6327636d58c08a48342
SSDEEP 49152:Wp888OhpdWIxJ1T1f0j3f3CQVHMTyEfa34OKEe5:ludWIP1TOfszJE2
TLSH
T162758E0AA2B901F8D067D179C9065517EBB2B8051F34A7DF5790CEA62F23EE11B7E324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing Discord tokens regular expressions 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_Discord_Regex

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.6MB

2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 973f2fc37517aa324d04d42e02d9ae64
SHA256 cf468466c6aec4130488e2bb87dc83fdea0ab2abd606cb49bf918bdfd33941fc
MD5 4fb0b3996d6b58eb17b133528800d134
SHA1 094802ad7f372ae6a670f37c77d04000dcc92986
SHA512 56ca8cf62b339830d92f076a5d5a855d873c1a2138d5ac2e13c572cba940a7ebabe116ca07e793c854fd3f786ae5ca4b33742a633894e6327636d58c08a48342
SSDEEP 49152:Wp888OhpdWIxJ1T1f0j3f3CQVHMTyEfa34OKEe5:ludWIP1TOfszJE2
TLSH
T162758E0AA2B901F8D067D179C9065517EBB2B8051F34A7DF5790CEA62F23EE11B7E324
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables referencing Discord tokens regular expressions
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1142288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Admin\source\repos\UberStealer\x64\Release\UberStealer.pdb

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptSetProperty BCryptGenerateSymmetricKey

crypt32

CryptUnprotectData CryptStringToBinaryA

advapi32

RegCloseKey RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegQueryValueExW

winhttp

WinHttpCloseHandle WinHttpSetOption WinHttpReadData WinHttpSendRequest WinHttpOpenRequest WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpen WinHttpConnect

kernel32

WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime GetModuleHandleW FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime GetFullPathNameW CreateFileMappingW SetStdHandle QueryPerformanceCounter GetTickCount FlushFileBuffers GetVolumeInformationW GetCurrentProcess GetModuleFileNameW FreeConsole CreateThread GetLocalTime CreateProcessA MulDiv IsDebuggerPresent CheckRemoteDebuggerPresent SetUnhandledExceptionFilter LoadLibraryExW VirtualProtect UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetCommandLineW GetCommandLineA GetStdHandle TerminateProcess ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx GetStringTypeW GetCPInfo CompareStringEx DecodePointer EncodePointer InitializeCriticalSectionEx LCMapStringEx GetLocaleInfoEx GetFileInformationByHandleEx CopyFile2 EnumSystemLocalesW EnterCriticalSection HeapFree HeapCreate TryEnterCriticalSection ReadFile AreFileApisANSI GetTimeZoneInformation GetFileSizeEx SetFilePointerEx GetFileType GetConsoleOutputCP GetConsoleMode ReadConsoleW IsValidCodePage GetACP GetOEMCP SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FormatMessageA GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW CreateFile2 SetFileInformationByHandle WriteConsoleW MapViewOfFile RtlUnwind GetFinalPathNameByHandleW GetStartupInfoW InitializeSListHead CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle

user32

GetMessageA CallWindowProcW SetProcessDpiAwarenessContext DispatchMessageA GetWindowRect LoadCursorA DefWindowProcW InflateRect GetDC FillRect CreateWindowExW ScreenToClient SendMessageW CallNextHookEx GetSystemMetrics GetWindowLongPtrW DestroyWindow ShowWindow GetWindowTextA TrackMouseEvent FrameRect SetWindowTextA GetForegroundWindow UnhookWindowsHookEx TranslateMessage SetWindowsHookExW ToUnicode GetClientRect GetDlgItem PeekMessageA DrawTextW PostQuitMessage SetForegroundWindow GetDpiForSystem InvalidateRect ReleaseDC BeginPaint EndPaint GetWindowTextW RegisterClassExW CreateWindowExA

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC GetStockObject CreateRoundRectRgn GetDIBits DeleteDC SetTextColor SetBkMode LineTo CreatePen Rectangle SelectClipRgn CreateFontIndirectA MoveToEx SetBkColor DeleteObject CreateSolidBrush RoundRect

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoUninitialize

oleaut32

SysFreeString SysAllocString VariantClear VariantInit

comctl32

ord410 ord412

msimg32

GradientFill

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

226KB

Virtual Size

225KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_4fb0b3996d6b58eb17b133528800d134_cobalt-strike_icedid_njrat_satacom_stealc

bcrypt

crypt32

advapi32

winhttp

kernel32

user32

gdi32

ole32

oleaut32

comctl32

msimg32

generic