2026-08-19_f3f0297f482d1b22a00595c43b104dc7_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_f3f0297f482d1b22a00595c43b104dc7_cobalt-strike_icedid_njrat_satacom_stealc
Size 532KB
Sample260819-plkbystfph
SHA256 b5d949fefaa03c73fc246a99e6d193c7520e7e1d2f25158acaa7350640e97d2f
MD5 f3f0297f482d1b22a00595c43b104dc7
SHA1 c038a1231955f9c275d6f3d6562ee5a6d2f23005
SHA512 8608e911099187c8705b1481b1c1de12eab94ed8bf3d41520cfb7ef37a52dc7ad99cd20f1a4adea1083cea74b15b5dac27e1e3c72dc4322175d00bd93b7648bb
SSDEEP 6144:99yTq1qdhmi+imwlnKCGe22xuUT/xrsw8uUiR9XU1hI3:/V1i+ARKCsmuUT/xQw/XU
TLSH
T10EC48E25EBA510FDE177D5B8C9624D02DB72BC8A0361AACF23904DA21F176D49F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_f3f0297f482d1b22a00595c43b104dc7_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-19_f3f0297f482d1b22a00595c43b104dc7_cobalt-strike_icedid_njrat_satacom_stealc

.exe 532KB

2026-08-19_f3f0297f482d1b22a00595c43b104dc7_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 9ebb489fc7efe665458fe2c23f91dfe8
SHA256 b5d949fefaa03c73fc246a99e6d193c7520e7e1d2f25158acaa7350640e97d2f
MD5 f3f0297f482d1b22a00595c43b104dc7
SHA1 c038a1231955f9c275d6f3d6562ee5a6d2f23005
SHA512 8608e911099187c8705b1481b1c1de12eab94ed8bf3d41520cfb7ef37a52dc7ad99cd20f1a4adea1083cea74b15b5dac27e1e3c72dc4322175d00bd93b7648bb
SSDEEP 6144:99yTq1qdhmi+imwlnKCGe22xuUT/xrsw8uUiR9XU1hI3:/V1i+ARKCsmuUT/xQw/XU
TLSH
T10EC48E25EBA510FDE177D5B8C9624D02DB72BC8A0361AACF23904DA21F176D49F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

389120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

SetServiceStatus StartServiceCtrlDispatcherW ConvertStringSecurityDescriptorToSecurityDescriptorW RegisterServiceCtrlHandlerW

bcrypt

BCryptGenRandom BCryptDestroyKey BCryptImportKeyPair BCryptDecrypt BCryptEncrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty BCryptOpenAlgorithmProvider

crypt32

CryptImportPublicKeyInfoEx2 CryptDecodeObjectEx CryptStringToBinaryA

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen

kernel32

ReadConsoleW CreateFileW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW HeapSize SetEndOfFile WriteConsoleW SetStdHandle FindFirstFileExW FindClose HeapReAlloc SetFilePointerEx GetFileSizeEx GetOEMCP GetACP IsValidCodePage GetConsoleOutputCP GetFileType GetStdHandle FlushFileBuffers ReadFile WriteFile CloseHandle GetLastError ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW QueryPerformanceCounter QueryPerformanceFrequency HeapCreate HeapAlloc HeapFree GetProcessHeap GetOverlappedResult InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent WaitForSingleObject CreateMutexW CreateEventW Sleep WaitForMultipleObjects GetCurrentProcessId TerminateProcess SwitchToThread GetCurrentThreadId TlsAlloc TlsSetValue TlsFree CreateProcessW OpenProcess GlobalMemoryStatusEx GetSystemInfo GetSystemTimeAsFileTime GetLocalTime GetTickCount64 GetModuleFileNameW LocalFree WideCharToMultiByte GetConsoleMode SetConsoleMode CreateToolhelp32Snapshot Process32FirstW Process32NextW GetSystemTimePreciseAsFileTime WaitForSingleObjectEx GetExitCodeThread InitializeCriticalSectionEx DeleteCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW InitializeSListHead EnumSystemLocalesW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess ExitProcess GetProcAddress GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID

Name

.text

Size

241KB

Virtual Size

241KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

832B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcdf17

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_f3f0297f482d1b22a00595c43b104dc7_cobalt-strike_icedid_njrat_satacom_stealc

advapi32

bcrypt

crypt32

winhttp

kernel32

generic