2026-08-16_a5f7fc024b3381ac51b681bd89bfac7c_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_a5f7fc024b3381ac51b681bd89bfac7c_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.2MB
Sample260816-ejrm5syhka
SHA256 b1e2eeb747a654423c194fe57df050b2a291a15fa5d443f991f03a239516010d
MD5 a5f7fc024b3381ac51b681bd89bfac7c
SHA1 a0fb14e3696330e41c3819347990e857b9984eeb
SHA512 9318e3eb9591e78ad16b629559c74e6b08e7433f141fbd0fb83027057c16b1b6959e8797342f13408c6aa7a77cf8d694ec4056abcc68dd60b8fddea1e0e5397d
SSDEEP 12288:aPeqV5lHwLNnJdbOW1/BmABCSLxcdymMliIQeDhxi:aqT1FBCexliId
TLSH
T138452A15A7E8266DF2F39734DB7742C2C67ABC459B34D6EF018030590E3AB94793AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_a5f7fc024b3381ac51b681bd89bfac7c_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-16_a5f7fc024b3381ac51b681bd89bfac7c_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.2MB

2026-08-16_a5f7fc024b3381ac51b681bd89bfac7c_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH ddeeabd436e8cec911fe339d3458904a
SHA256 b1e2eeb747a654423c194fe57df050b2a291a15fa5d443f991f03a239516010d
MD5 a5f7fc024b3381ac51b681bd89bfac7c
SHA1 a0fb14e3696330e41c3819347990e857b9984eeb
SHA512 9318e3eb9591e78ad16b629559c74e6b08e7433f141fbd0fb83027057c16b1b6959e8797342f13408c6aa7a77cf8d694ec4056abcc68dd60b8fddea1e0e5397d
SSDEEP 12288:aPeqV5lHwLNnJdbOW1/BmABCSLxcdymMliIQeDhxi:aqT1FBCexliId
TLSH
T138452A15A7E8266DF2F39734DB7742C2C67ABC459B34D6EF018030590E3AB94793AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

363584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle CancelIoEx GetOverlappedResult GetNamedPipeServerProcessId UnregisterWaitEx LocalFree GetCurrentProcessId MapViewOfFile ConnectNamedPipe FindFirstFileW GetPackageFamilyName FindClose GetFileAttributesW GetCurrentThreadId CreateToolhelp32Snapshot Process32NextW Process32FirstW SwitchToThread GetWindowsDirectoryW QueryFullProcessImageNameW GetSystemTimeAsFileTime QueryPerformanceCounter GetTickCount GetProcessTimes GetExitCodeProcess QueryPerformanceFrequency MulDiv IsWow64Process2 CompareStringOrdinal Thread32Next GetProcessMitigationPolicy Thread32First LoadLibraryW ResetEvent Module32FirstW GetProcAddress CreateProcessW FreeLibrary Module32NextW GetFileSizeEx CreateMutexW ReleaseMutex FormatMessageW GetFileAttributesExW ReleaseSRWLockExclusive FileTimeToSystemTime AcquireSRWLockExclusive DeleteFileW ReleaseSRWLockShared MoveFileExW AcquireSRWLockShared GetModuleHandleW WideCharToMultiByte GetSystemTime OpenMutexW GetSystemTimePreciseAsFileTime FlushFileBuffers MultiByteToWideChar CreateThread GetFileSize GetUserDefaultLocaleName LockResource FindResourceExW LoadResource GetCommandLineW GetSystemPowerStatus CancelWaitableTimer GetPrivateProfileStringW SetWaitableTimerEx GetNativeSystemInfo GlobalLock GlobalMemoryStatusEx CreateWaitableTimerExW CreateFileMappingW GlobalUnlock LoadLibraryExW SetUnhandledExceptionFilter Sleep HeapSize GetConsoleMode GetConsoleOutputCP GetStringTypeW SetStdHandle GetProcessHeap GetLastError FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW SetFilePointerEx HeapReAlloc GetTimeZoneInformation LCMapStringW CompareStringW VirtualProtect GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SleepConditionVariableSRW WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete GetExitCodeThread WaitForSingleObjectEx CreateEventW OpenProcess UnmapViewOfFile OpenFileMappingW OpenEventW CreateFileW WaitForSingleObject GetNamedPipeClientProcessId GetProcessId WaitForMultipleObjects CreateNamedPipeW GetModuleFileNameW TerminateProcess RegisterWaitForSingleObject WriteFile GetCurrentProcess SetLastError SetNamedPipeHandleState SetEvent SetEnvironmentVariableW GetTickCount64 WriteConsoleW ReadFile

user32

PostThreadMessageW GetClassNameW TranslateMessage MsgWaitForMultipleObjectsEx PeekMessageW SetWinEventHook DispatchMessageW EnumDisplaySettingsW UnhookWinEvent GetWindowLongPtrW EnumChildWindows MonitorFromWindow GetWindowRect FindWindowExW GetWindowThreadProcessId GetParent SetWindowsHookExW EnumWindows UnhookWindowsHookEx IsWindowVisible SendMessageTimeoutW GetForegroundWindow GetMonitorInfoW PostMessageW GetCursorPos IsWindow IsIconic GetMessageW DefWindowProcW GetThreadDpiAwarenessContext GetKeyState DestroyWindow SetWindowPos MessageBoxW GetDpiForWindow AdjustWindowRectExForDpi EnumDisplayMonitors CreateWindowExW ScreenToClient SendMessageW GetSystemMetrics UnregisterClassW CreatePopupMenu RegisterClassExW ShowWindow TrackPopupMenu OpenClipboard GetCapture SetTimer CloseClipboard SetMenuInfo ValidateRect TrackMouseEvent AreDpiAwarenessContextsEqual DestroyMenu SetFocus GetClipboardData FindWindowW LoadCursorW SetCapture SetCursor GetClientRect GetMenuInfo AppendMenuW GetCaretBlinkTime KillTimer PostQuitMessage SystemParametersInfoW RegisterWindowMessageW UpdateWindow ReleaseCapture SetForegroundWindow LoadImageW GetDpiForSystem InvalidateRect

advapi32

CopySid ConvertStringSecurityDescriptorToSecurityDescriptorW AllocateAndInitializeSid FreeSid CheckTokenMembership RegGetValueW ConvertStringSidToSidW SetEntriesInAclW SetNamedSecurityInfoW GetTokenInformation GetNamedSecurityInfoW IsValidSid SetSecurityInfo GetLengthSid GetSecurityInfo OpenProcessToken ConvertSidToStringSidW

shell32

ShellExecuteExW ShellExecuteW CommandLineToArgvW Shell_NotifyIconW

ole32

CoUninitialize CoCreateInstance CoInitializeEx

oleaut32

VariantInit VariantClear SysAllocStringLen SysFreeString SysAllocString SysStringLen

bcrypt

BCryptGenRandom

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute

crypt32

CryptUnprotectData CryptProtectData

steam_api64

SteamAPI_Shutdown SteamAPI_GetHSteamUser SteamAPI_IsSteamRunning SteamInternal_SteamAPI_Init SteamAPI_RegisterCallback SteamInternal_FindOrCreateUserInterface SteamAPI_RunCallbacks SteamInternal_ContextInit SteamAPI_UnregisterCallback

d2d1

ord1

dwrite

DWriteCreateFactory

dxgi

CreateDXGIFactory1

Name

.text

Size

482KB

Virtual Size

482KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

177KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512KB

Virtual Size

512KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_a5f7fc024b3381ac51b681bd89bfac7c_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

ole32

oleaut32

bcrypt

version

dwmapi

crypt32

steam_api64

d2d1

dwrite

dxgi

generic