2026-08-19_d947e40c1c052667fbe6156d8fc3eed3_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_d947e40c1c052667fbe6156d8fc3eed3_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_stealc
Size 815KB
Sample260819-ermddswepa
SHA256 ed6376211851add62408b5955d208e2c938a34dfabee6dfeadf7dc586c582c11
MD5 d947e40c1c052667fbe6156d8fc3eed3
SHA1 570411394219acbaecc826b5b045b3dc218609a7
SHA512 6d3e3a6bc85ffeadb470c02ed2774b86c982c5f6b1c7337e9ee76d668f8ea80a12378df94955248324ffefba95a981b02c4c758d3a42af945bcee658e57c80e1
SSDEEP 24576:wfFl7TNCX1HHGFxwj37D3XEN5eIZjHNtwNDCnr6C:2FltunSwTXEN5eIZjHNtwNDCnr6C
TLSH
T14E057C17F66910FAC4AAC179DB469912AA72B80A4730BEDF178187223F53EE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_d947e40c1c052667fbe6156d8fc3eed3_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_stealc

File Explorer

2026-08-19_d947e40c1c052667fbe6156d8fc3eed3_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_stealc

.exe 815KB

2026-08-19_d947e40c1c052667fbe6156d8fc3eed3_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_stealc

IMPHASH 3e14399df8e73d5cbadd360d093eb317
SHA256 ed6376211851add62408b5955d208e2c938a34dfabee6dfeadf7dc586c582c11
MD5 d947e40c1c052667fbe6156d8fc3eed3
SHA1 570411394219acbaecc826b5b045b3dc218609a7
SHA512 6d3e3a6bc85ffeadb470c02ed2774b86c982c5f6b1c7337e9ee76d668f8ea80a12378df94955248324ffefba95a981b02c4c758d3a42af945bcee658e57c80e1
SSDEEP 24576:wfFl7TNCX1HHGFxwj37D3XEN5eIZjHNtwNDCnr6C:2FltunSwTXEN5eIZjHNtwNDCnr6C
TLSH
T14E057C17F66910FAC4AAC179DB469912AA72B80A4730BEDF178187223F53EE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

444672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Thalamus\Thalamus\build\clang-release\_deps-gclient\crashpad\out\Release\crashpad_handler.pdb

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler CloseHandle CompareStringW ConnectNamedPipe CreateDirectoryW CreateEventW CreateFileW CreateIoCompletionPort CreateNamedPipeW CreateProcessW CreateSemaphoreW CreateThread DecodePointer DeleteCriticalSection DeleteFileW DisconnectNamedPipe DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDriveTypeW GetEnvironmentStringsW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GetThreadLocale GetTimeZoneInformation GetUserDefaultLCID GetVersion HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalFree LockFileEx MultiByteToWideChar OpenProcess OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus QueryPerformanceCounter RaiseException ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetNamedPipeHandleState SetProcessShutdownParameters SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SuspendThread SystemTimeToTzSpecificLocalTime TerminateProcess TransactNamedPipe UnhandledExceptionFilter UnlockFileEx UnregisterWaitEx VerSetConditionMask VerifyVersionInfoW VirtualProtect VirtualQueryEx WaitForSingleObject WaitNamedPipeW WakeAllConditionVariable WideCharToMultiByte Wow64GetThreadContext WriteConsoleW WriteFile

advapi32

BuildExplicitAccessWithNameW BuildSecurityDescriptorW ConvertStringSecurityDescriptorToSecurityDescriptorW ImpersonateNamedPipeClient RegCloseKey RegOpenKeyExW RegQueryValueExA RegQueryValueExW RevertToSelf SystemFunction036

user32

CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetMessageW GetWindowLongPtrW PostMessageW RegisterClassW SetWindowLongPtrW TranslateMessage UnregisterClassW

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts WinHttpWriteData

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

powrprof

CallNtPowerInformation

Name

.text

Size

614KB

Virtual Size

614KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

155KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_d947e40c1c052667fbe6156d8fc3eed3_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_stealc

kernel32

advapi32

user32

winhttp

version

powrprof

generic