2026-08-19_ecc59b85d9b4ed5a611da09cd865d891_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_ecc59b85d9b4ed5a611da09cd865d891_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.3MB
Sample260819-ehe8qawdqe
SHA256 17b53ef84b5cca3d8a532ba71ec837ab0495383200a00db1244a07028ed0971e
MD5 ecc59b85d9b4ed5a611da09cd865d891
SHA1 8efbb44297c06f7c6e9e85853578fd680ee1ee38
SHA512 374c006b65af36357af0d5bc7f32187fc82aae6dccae39e7dc0fa430d4a41d3aec5d7694d904bb0b5c67413804dc4b6d7100f8a969a86ddedf5cab900eb54f72
SSDEEP 24576:q6+dOGM5SQ5GxqCAhlIYEP+pOmIvEuiaRnnN:q68ObkxqCLGUogn
TLSH
T12455BF4D73B841F8D1ABD1B9DA91590BFB357419073089EB83E40A182F63BE49E7B712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_ecc59b85d9b4ed5a611da09cd865d891_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-19_ecc59b85d9b4ed5a611da09cd865d891_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.3MB

2026-08-19_ecc59b85d9b4ed5a611da09cd865d891_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 90592c4db2d376bad23eea2455b891b8
SHA256 17b53ef84b5cca3d8a532ba71ec837ab0495383200a00db1244a07028ed0971e
MD5 ecc59b85d9b4ed5a611da09cd865d891
SHA1 8efbb44297c06f7c6e9e85853578fd680ee1ee38
SHA512 374c006b65af36357af0d5bc7f32187fc82aae6dccae39e7dc0fa430d4a41d3aec5d7694d904bb0b5c67413804dc4b6d7100f8a969a86ddedf5cab900eb54f72
SSDEEP 24576:q6+dOGM5SQ5GxqCAhlIYEP+pOmIvEuiaRnnN:q68ObkxqCLGUogn
TLSH
T12455BF4D73B841F8D1ABD1B9DA91590BFB357419073089EB83E40A182F63BE49E7B712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

661904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ARI\Desktop\Steam\CSS2\cs2 project\cs2 project\x64\Release\Aure.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

kernel32

GetTickCount64 Process32NextW Process32FirstW CloseHandle GetWindowsDirectoryA Module32FirstW ReadProcessMemory GetConsoleWindow Module32NextW VirtualFree VirtualAlloc GetCurrentThreadId GetModuleHandleA GetProcAddress GetCurrentProcessId GetModuleFileNameW GetTempPathW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID Sleep GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent ReadFile DeleteFileW GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread CreateToolhelp32Snapshot OpenProcess GetFileAttributesW CreateFileW DeviceIoControl WriteProcessMemory GetModuleFileNameA GetProcessHeap SetStdHandle FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry HeapSize WriteConsoleW SetEndOfFile IsValidLocale FormatMessageA LocalFree RtlUnwind GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead

user32

SendInput SetWindowLongW UpdateWindow RegisterClassExA GetDesktopWindow GetCursorPos LoadCursorW GetClipboardData LoadIconW GetKeyState ScreenToClient ClientToScreen GetKeyboardLayout GetForegroundWindow SetCursor GetClientRect SetCursorPos OpenClipboard CloseClipboard EmptyClipboard TranslateMessage SetClipboardData GetWindowRect DestroyWindow SetWindowPos GetSystemMetrics ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW SetWindowDisplayAffinity MessageBoxA DefWindowProcA CreateWindowExA SetLayeredWindowAttributes BringWindowToTop UnregisterClassA

advapi32

RegCloseKey RegDeleteTreeW RegSetKeyValueW RegOpenKeyW RegCreateKeyW

shell32

ShellExecuteA

ntdll

RtlInitUnicodeString NtLoadDriver NtUnloadDriver NtQuerySystemInformation RtlAdjustPrivilege

winmm

timeBeginPeriod

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

850KB

Virtual Size

849KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

417KB

Virtual Size

417KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_ecc59b85d9b4ed5a611da09cd865d891_cobalt-strike_icedid_njrat_satacom_stealc

d3d11

d3dcompiler_47

dwmapi

kernel32

user32

advapi32

shell32

ntdll

winmm

imm32

generic