2026-08-16_d4f4a966c5e2ff0e11bbfde605cd006d_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_d4f4a966c5e2ff0e11bbfde605cd006d_cobalt-strike_icedid_njrat_satacom_stealc
Size 328KB
Sample260816-lr665avth1
SHA256 ba2703796d856e89987ecd5221ac836527866d6e556fc736c8358bcb4de05217
MD5 d4f4a966c5e2ff0e11bbfde605cd006d
SHA1 ea32133286b0bc354c6dd8601ebffd3da859cb81
SHA512 57a2719c0712a30f4bd1d0ecc760ab289f46f7e269286808d9062cbf436f870dbb9a81c9bf2a35a3aa8e042f6bb0521fe31303c1f9ab99077f8d0ddebf0da79e
SSDEEP 6144:v07puiPidOZTfKTXdFxNGpBvONcwpyGzMFvc3:hSiUZ8lGpBvONJHzMF
TLSH
T13A645B15E6D410F9E2B7D278CE670906EB72BC560731A7DF139086962F23AD48E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_d4f4a966c5e2ff0e11bbfde605cd006d_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-16_d4f4a966c5e2ff0e11bbfde605cd006d_cobalt-strike_icedid_njrat_satacom_stealc

.exe 328KB

2026-08-16_d4f4a966c5e2ff0e11bbfde605cd006d_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 5e0e0e941f0ad9ec042bcfe02eb2430e
SHA256 ba2703796d856e89987ecd5221ac836527866d6e556fc736c8358bcb4de05217
MD5 d4f4a966c5e2ff0e11bbfde605cd006d
SHA1 ea32133286b0bc354c6dd8601ebffd3da859cb81
SHA512 57a2719c0712a30f4bd1d0ecc760ab289f46f7e269286808d9062cbf436f870dbb9a81c9bf2a35a3aa8e042f6bb0521fe31303c1f9ab99077f8d0ddebf0da79e
SSDEEP 6144:v07puiPidOZTfKTXdFxNGpBvONcwpyGzMFvc3:hSiUZ8lGpBvONJHzMF
TLSH
T13A645B15E6D410F9E2B7D278CE670906EB72BC560731A7DF139086962F23AD48E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

85872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\MaaAssistantArknights\MaaAssistantArknights\build\bin\RelWithDebInfo\MAA.Updater.pdb

kernel32

RemoveDirectoryW WriteFile CloseHandle GetLastError ReleaseMutex WaitForSingleObject CreateMutexW Sleep CreateProcessW OpenProcess GetLocalTime GetTickCount GetModuleHandleW CopyFileW MoveFileExW ReplaceFileW MultiByteToWideChar WideCharToMultiByte GetConsoleMode WriteConsoleW HeapSize ReadFile SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW HeapReAlloc GetOEMCP GetACP IsValidCodePage SetFilePointerEx GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetFullPathNameW GetFileSizeEx GetUserDefaultLCID IsValidLocale GetFileAttributesW FindNextFileW GetLocaleInfoW LCMapStringW FindFirstFileW FindClose DeleteFileW CreateFileW CreateDirectoryW ReadConsoleW GetStdHandle GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetModuleFileNameW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW RtlUnwind

user32

TranslateMessage LoadCursorW FillRect MessageBoxW GetClientRect SetWindowTextW RedrawWindow SetForegroundWindow UpdateWindow GetSystemMetrics ShowWindow DestroyWindow CreateWindowExW RegisterClassExW DefWindowProcW SendMessageW PeekMessageW DispatchMessageW

comctl32

InitCommonControlsEx

shell32

SHFileOperationW

advapi32

RegGetValueW

dwmapi

DwmSetWindowAttribute

gdi32

CreateSolidBrush SetBkColor SetBkMode DeleteObject GetStockObject SetTextColor

Name

.text

Size

210KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_d4f4a966c5e2ff0e11bbfde605cd006d_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

comctl32

shell32

advapi32

dwmapi

gdi32

generic