2026-08-17_74a5b35c638583cd16e2221d5b9b3448_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-17_74a5b35c638583cd16e2221d5b9b3448_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.1MB
Sample260817-d4nxbaseqc
SHA256 6b8903098fdd4d8b6d7076a607c49736d63fb4730f944c6eefef6ebff402e0e8
MD5 74a5b35c638583cd16e2221d5b9b3448
SHA1 4f30ebf6d849b4b6d1e9d16b32965c9e387ef9a8
SHA512 5ef6914a9460e3bf4b8e79e0c103b040d692be7f6cbe9034c850ad06817f14d41e24d6da0fa0a557998f3e807229561341e185501937aa9f7294ef96feff85af
SSDEEP 24576:a4kJrNhi8IggrT7sjjq4j9CcnVT18RH/Dui+AcZJUz:a4R8IgqIjjdRCcVT2hDnLczw
TLSH
T10B35CF1972B441F9C07AC2B5CDA79617EB72780A13309ADB13E05A992F633F09A7F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-17_74a5b35c638583cd16e2221d5b9b3448_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-17_74a5b35c638583cd16e2221d5b9b3448_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.1MB

2026-08-17_74a5b35c638583cd16e2221d5b9b3448_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 82ff6345f32e7efac0931a651ebdabd8
SHA256 6b8903098fdd4d8b6d7076a607c49736d63fb4730f944c6eefef6ebff402e0e8
MD5 74a5b35c638583cd16e2221d5b9b3448
SHA1 4f30ebf6d849b4b6d1e9d16b32965c9e387ef9a8
SHA512 5ef6914a9460e3bf4b8e79e0c103b040d692be7f6cbe9034c850ad06817f14d41e24d6da0fa0a557998f3e807229561341e185501937aa9f7294ef96feff85af
SSDEEP 24576:a4kJrNhi8IggrT7sjjq4j9CcnVT18RH/Dui+AcZJUz:a4R8IgqIjjdRCcVT2hDnLczw
TLSH
T10B35CF1972B441F9C07AC2B5CDA79617EB72780A13309ADB13E05A992F633F09A7F711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

607760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

shell32

DragQueryFileW SHCreateShellItemArrayFromDataObject ord727 SHGetFileInfoW Shell_NotifyIconW ShellExecuteW CommandLineToArgvW SHParseDisplayName ShellExecuteExW

shlwapi

AssocQueryStringW

comdlg32

GetSaveFileNameW GetOpenFileNameW

ole32

RegisterDragDrop OleInitialize OleUninitialize CoInitializeEx CoUninitialize ReleaseStgMedium CoTaskMemFree CoCreateInstance RevokeDragDrop

gdi32

GetObjectW DeleteObject SelectObject CreateCompatibleDC CreateDIBSection GetDeviceCaps DeleteDC

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle CreateFileW HeapSize WriteConsoleW HeapReAlloc GetOEMCP GetACP GetModuleFileNameW FormatMessageW GetLastError LocalFree MoveFileExW WideCharToMultiByte GetUserDefaultUILanguage MultiByteToWideChar GetCurrentThreadId GetTickCount64 GetModuleHandleW GetPrivateProfileStringW GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock GlobalUnlock SetPriorityClass GetCommandLineW GetCurrentProcess CompareStringOrdinal CreateMutexW Sleep CloseHandle SetProcessWorkingSetSize FlushFileBuffers GetFileType SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle TerminateProcess GetConsoleOutputCP IsProcessorFeaturePresent ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetExitCodeThread WaitForSingleObjectEx SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive RaiseException RtlPcToFileHeader GetSystemTimePreciseAsFileTime GetLocaleInfoEx FormatMessageA GetFileInformationByHandleEx IsValidLocale CopyFile2 AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFullPathNameW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW IsValidCodePage GetConsoleMode HeapFree HeapAlloc VirtualProtect LoadLibraryExW ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID LCMapStringW GetLocaleInfoW SetEndOfFile ExitProcess RtlUnwind GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW

user32

RedrawWindow GetMonitorInfoW SetLayeredWindowAttributes FindWindowW KillTimer PostQuitMessage UpdateWindow IsIconic OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo GetDC MonitorFromWindow ScreenToClient GetCapture TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC ShowWindow MapVirtualKeyW GetAsyncKeyState GetKeyNameTextW SetWindowPos ClientToScreen PtInRect GetIconInfo IsWindowVisible CreatePopupMenu TrackPopupMenu DestroyMenu AppendMenuW SetForegroundWindow GetCursorPos CopyIcon PrivateExtractIconsW DestroyIcon DrawIconEx LoadImageW GetMessageW UnregisterHotKey PostMessageW CallNextHookEx DispatchMessageW PeekMessageW GetDoubleClickTime RegisterHotKey UnhookWindowsHookEx TranslateMessage SetWindowsHookExW PostThreadMessageW WaitMessage SetTimer GetWindowLongPtrW RegisterClassExW SetWindowTextW UnregisterClassW CreateWindowExW SetWindowLongPtrW MessageBoxW DestroyWindow MonitorFromPoint GetWindowRect DefWindowProcW LoadIconW

advapi32

RegQueryValueExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey

d3dcompiler_47

D3DCompile

imm32

ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow ImmGetContext

Name

.text

Size

796KB

Virtual Size

795KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

194KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-17_74a5b35c638583cd16e2221d5b9b3448_cobalt-strike_icedid_njrat_satacom_stealc

d3d11

shell32

shlwapi

comdlg32

ole32

gdi32

version

kernel32

user32

advapi32

d3dcompiler_47

imm32

generic