2026-08-19_d7bcc2f7cd3193898804c0fbb25584aa_cobalt-strike_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_d7bcc2f7cd3193898804c0fbb25584aa_cobalt-strike_icedid_njrat_satacom
Size 412KB
Sample260819-mwsd7stycv
SHA256 a5e5cf6c08aa4a24ae5817c415cf4b35e54e30fb34858a966850062be878e072
MD5 d7bcc2f7cd3193898804c0fbb25584aa
SHA1 ab1572189d12955437de14f083714f049cb3014d
SHA512 d3dca1d15a3016ee886c8ddfb7ffda89d8e60e4366097ade25aa4745c6600f0204c9b8f157fcabb63436e08d3d59f96c59728c4efb278a0ba26bec71d9b3a57f
SSDEEP 12288:UOoKe4XGDfkQ3mbTx6TyF461FmJHehPi:UOo2X4fkXTdr1SHB
TLSH
T117949E56E39925E9E863C13DC952C546EB72BC1A0320DBDF23A4A6183F337D19D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_d7bcc2f7cd3193898804c0fbb25584aa_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-08-19_d7bcc2f7cd3193898804c0fbb25584aa_cobalt-strike_icedid_njrat_satacom

.exe 412KB

2026-08-19_d7bcc2f7cd3193898804c0fbb25584aa_cobalt-strike_icedid_njrat_satacom

IMPHASH fe01938d12d3b2073676c7da80b35b1c
SHA256 a5e5cf6c08aa4a24ae5817c415cf4b35e54e30fb34858a966850062be878e072
MD5 d7bcc2f7cd3193898804c0fbb25584aa
SHA1 ab1572189d12955437de14f083714f049cb3014d
SHA512 d3dca1d15a3016ee886c8ddfb7ffda89d8e60e4366097ade25aa4745c6600f0204c9b8f157fcabb63436e08d3d59f96c59728c4efb278a0ba26bec71d9b3a57f
SSDEEP 12288:UOoKe4XGDfkQ3mbTx6TyF461FmJHehPi:UOo2X4fkXTdr1SHB
TLSH
T117949E56E39925E9E863C13DC952C546EB72BC1A0320DBDF23A4A6183F337D19D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

109584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\卡密管理系统\DT-驱动项目\KDU-master\KDU-master\Source\Hamakaze\output\x64\Release\kdu.pdb

kernel32

ReadFile WriteFile SetFilePointer TerminateProcess Sleep VirtualUnlock VirtualLock TerminateThread CreateThread HeapSetInformation SetDllDirectoryW GetStdHandle CreateFileW WriteConsoleW WideCharToMultiByte GetFileType SetHandleInformation GetHandleInformation OpenProcess OpenThread VirtualFree CreateEventW GetProcessHeap GetConsoleScreenBufferInfo SetConsoleTextAttribute GetCommandLineW GetModuleFileNameW FormatMessageW GetSystemInfo VirtualAllocEx ReadProcessMemory GetSystemTimeAsFileTime VirtualFreeEx CreateFileMappingW MapViewOfFile GetFirmwareEnvironmentVariableW GetConsoleMode ExpandEnvironmentStringsW LoadLibraryW GetCurrentDirectoryW HeapFree HeapReAlloc GetModuleHandleW CreateProcessW DeleteFileW UnmapViewOfFile ResumeThread WriteProcessMemory GetStartupInfoW HeapDestroy HeapAlloc HeapCreate LoadLibraryExW FreeLibrary GetProcAddress GetSystemDirectoryW RtlCompareMemory CloseHandle WaitForSingleObject GetLastError GetCurrentProcess HeapSize GetFileSizeEx SetFilePointerEx GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetConsoleOutputCP FlushFileBuffers LCMapStringW CompareStringW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetCommandLineA GetModuleHandleExW ExitProcess RtlPcToFileHeader RaiseException EncodePointer RtlLookupFunctionEntry DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId VirtualAlloc SetLastError

advapi32

RegCloseKey RegQueryValueExW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegDeleteKeyW RegOpenKeyExW

crypt32

CryptMsgOpenToDecode CertFreeCertificateContext CertCloseStore CryptMsgClose CertCreateCertificateContext CertOpenStore CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW CryptMsgUpdate

ntdll

LdrLockLoaderLock RtlTimeToSecondsSince1970 NtTerminateProcess NtWaitForSingleObject NtSetInformationProcess NtOpenSection LdrFindEntryForAddress NtFsControlFile RtlLengthRequiredSid LdrUnlockLoaderLock NtSetValueKey RtlEqualUnicodeString LdrGetProcedureAddress RtlNtdllName NtQueryObject NtDuplicateObject RtlAdjustPrivilege NtSetSecurityObject RtlDoesFileExists_U NtCreateMutant RtlGetVersion LdrUnloadDll NtAlpcCreatePort RtlCreateAcl NtAlpcAcceptConnectPort NtAlpcDisconnectPort NtOpenFile RtlCreateSecurityDescriptor RtlAddAccessAllowedAce RtlLengthSid NtReplyWaitReceivePort RtlSetDaclSecurityDescriptor RtlSubAuthoritySid RtlInitializeSid NtDeviceIoControlFile NtLoadDriver NtUnloadDriver NtOpenKey NtUnmapViewOfSection LdrLoadDll NtCreateSection LdrAccessResource RtlSetLastWin32Error NtCreateFile RtlNtStatusToDosError RtlEqualSid RtlInitString RtlFreeHeap NtQueryDirectoryObject RtlFreeSid RtlExpandEnvironmentStrings NtOpenDirectoryObject NtFlushBuffersFile RtlUnicodeStringToAnsiString NtClose NtQueryInformationToken RtlAllocateAndInitializeSid LdrFindResource_U RtlDosPathNameToNtPathName_U RtlInitUnicodeString NtOpenProcess RtlFreeUnicodeString NtQueryInformationProcess NtWriteFile NtQuerySystemInformation RtlAllocateHeap NtOpenThread NtFreeVirtualMemory NtOpenProcessToken RtlAnsiStringToUnicodeString RtlFreeAnsiString NtAdjustPrivilegesToken RtlImageNtHeader NtMapViewOfSection

rpcrt4

UuidCreate

setupapi

SetupDiCreateDeviceInfoW SetupDiSetDeviceRegistryPropertyW SetupDiCallClassInstaller InstallHinfSectionW SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiRemoveDevice SetupDiDestroyDeviceInfoList

newdev

UpdateDriverForPlugAndPlayDevicesW

bcrypt

BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptEncrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptGetProperty

fltlib

FilterConnectCommunicationPort FilterSendMessage

msdelta

ApplyDeltaB DeltaFree

Name

.text

Size

206KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_d7bcc2f7cd3193898804c0fbb25584aa_cobalt-strike_icedid_njrat_satacom

kernel32

advapi32

crypt32

ntdll

rpcrt4

setupapi

newdev

bcrypt

fltlib

msdelta

generic