2026-08-19_d71379dd566b3a4eccbdff32e2632427_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_d71379dd566b3a4eccbdff32e2632427_cobalt-strike_icedid_njrat_satacom_stealc
Size 554KB
Sample260819-ps6hrsfb22
SHA256 5ff4fdf137278efb3a2a3647c67b7e420a814c1b68f25c7f63cf07e474b31770
MD5 d71379dd566b3a4eccbdff32e2632427
SHA1 c9ee1f0b53488e54af0281ea666ba833b8af9023
SHA512 2ac77be87b23c573d6c65658d57579153a6f00880626acf87f7c28ed445df2032dccf15a54410a397a81a26f918f9e867433efe5fffcd397feded0e6af5c9f7d
SSDEEP 12288:s7VlCTf18DzbRQsCtCjKymbeDPkI4kA03aR7:T1ibFjKymbgPMkAX
TLSH
T1CBC41911EAE403BDE2B7D3B4CA635905E677798607316ACB0390956B0F276D88F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_d71379dd566b3a4eccbdff32e2632427_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-19_d71379dd566b3a4eccbdff32e2632427_cobalt-strike_icedid_njrat_satacom_stealc

.exe 554KB

2026-08-19_d71379dd566b3a4eccbdff32e2632427_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH f6b2c48b657dafa285e91ee407795a3d
SHA256 5ff4fdf137278efb3a2a3647c67b7e420a814c1b68f25c7f63cf07e474b31770
MD5 d71379dd566b3a4eccbdff32e2632427
SHA1 c9ee1f0b53488e54af0281ea666ba833b8af9023
SHA512 2ac77be87b23c573d6c65658d57579153a6f00880626acf87f7c28ed445df2032dccf15a54410a397a81a26f918f9e867433efe5fffcd397feded0e6af5c9f7d
SSDEEP 12288:s7VlCTf18DzbRQsCtCjKymbeDPkI4kA03aR7:T1ibFjKymbgPMkAX
TLSH
T1CBC41911EAE403BDE2B7D3B4CA635905E677798607316ACB0390956B0F276D88F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing artifacts associated with disabling Widnows Defender
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

250160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

OpenProcessToken GetTokenInformation ChangeServiceConfigW CloseServiceHandle CreateServiceW OpenSCManagerW OpenServiceW QueryServiceStatus RegisterServiceCtrlHandlerW SetServiceStatus StartServiceCtrlDispatcherW StartServiceW ImpersonateLoggedOnUser RevertToSelf RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegDeleteTreeW ControlService ChangeServiceConfig2W StartTraceW ControlTraceW EnableTraceEx2 OpenTraceW ProcessTrace CloseTrace RegEnumKeyExW RegEnumValueW CreateWellKnownSid EqualSid GetAce DeleteService QueryServiceConfigW GetNamedSecurityInfoW ChangeServiceConfigA CreateServiceA OpenSCManagerA OpenServiceA StartServiceA

crypt32

CryptMsgClose CryptMsgGetParam CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

shell32

SHGetKnownFolderPath SHGetFolderPathW CommandLineToArgvW ShellExecuteExW

ole32

CoCreateInstance CoTaskMemFree CoInitializeEx CoUninitialize StringFromGUID2

shlwapi

StrStrIW

tdh

TdhGetProperty

kernel32

WriteConsoleW SetEndOfFile HeapSize GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx GetCommandLineW CloseHandle GetLastError SetLastError SetErrorMode SetEvent WaitForSingleObject CreateEventW Sleep GetCurrentProcess CreateThread TerminateThread GetTickCount GetModuleFileNameW LocalFree AllocConsole FreeConsole GetConsoleWindow GetFileAttributesW GetExitCodeProcess CreateProcessW GetTickCount64 CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW CreateFileW GetOverlappedResult CancelIo ResetEvent WaitForMultipleObjects ReadDirectoryChangesW LocalAlloc GetFullPathNameW GetLocalTime GetUserDefaultUILanguage ExpandEnvironmentStringsW CopyFileW GetEnvironmentVariableW FindClose FindFirstFileW FindNextFileW WTSGetActiveConsoleSessionId GetSystemDirectoryW GetCurrentProcessId OpenProcess QueryFullProcessImageNameW GetCurrentThread SetThreadPriority DeleteFileW RemoveDirectoryW TerminateProcess GlobalMemoryStatusEx GetSystemInfo GetModuleHandleW DeviceIoControl ReleaseMutex CreateMutexW WideCharToMultiByte ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers FormatMessageA GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW CreateFile2 GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetStringTypeW GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile ExitProcess FreeLibrary GetModuleHandleExW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType RtlUnwind

user32

wsprintfW ShowWindow

Name

.text

Size

395KB

Virtual Size

394KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

131KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_d71379dd566b3a4eccbdff32e2632427_cobalt-strike_icedid_njrat_satacom_stealc

advapi32

crypt32

wtsapi32

shell32

ole32

shlwapi

tdh

kernel32

user32

generic