2026-08-20_90287d674eccf05c630c75ee579258fd_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-08-20_90287d674eccf05c630c75ee579258fd_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.7MB
Sample260820-cv5yssybpc
SHA256 ed48079afe452641242ce01144f0fd4c24086152761e76bc30c3ff127c8c7143
MD5 90287d674eccf05c630c75ee579258fd
SHA1 1dcec486664a5ecc1f6ef96b60d1743ffb2d21e7
SHA512 2b2e6f9b909163fbc477dbd77c1adac9fb53466c0ba5251aee2c5338aaa38ed0546cd893bae89ae77fc613660793b76cc2e4efe8e393e47320ccd77076fffd5e
SSDEEP 49152:CzffEHIXPAw4JgGpVUDXdBR+LLol+Qqlrq4MAWSYrAYogxsT5R:qr4mMLLo1grlMAgsTv
TLSH
T1C9858D17A2A800FCD1B7D1B5CA165907DB72B4490334AEEF42D099A62F13EF56B7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-20_90287d674eccf05c630c75ee579258fd_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-20_90287d674eccf05c630c75ee579258fd_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.7MB

2026-08-20_90287d674eccf05c630c75ee579258fd_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 39f6aa2635e110f028bb033b58dfcb19
SHA256 ed48079afe452641242ce01144f0fd4c24086152761e76bc30c3ff127c8c7143
MD5 90287d674eccf05c630c75ee579258fd
SHA1 1dcec486664a5ecc1f6ef96b60d1743ffb2d21e7
SHA512 2b2e6f9b909163fbc477dbd77c1adac9fb53466c0ba5251aee2c5338aaa38ed0546cd893bae89ae77fc613660793b76cc2e4efe8e393e47320ccd77076fffd5e
SSDEEP 49152:CzffEHIXPAw4JgGpVUDXdBR+LLol+Qqlrq4MAWSYrAYogxsT5R:qr4mMLLo1grlMAgsTv
TLSH
T1C9858D17A2A800FCD1B7D1B5CA165907DB72B4490334AEEF42D099A62F13EF56B7E720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

72:5b:3e:be:ee:75:56:77:6c:b2:17:d6:99:e3:ae:fe:d4:89:fd:79:95:80:7e:9e:48:e7:ce:02:94:33:d3:15

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Specimen Research Lab

Chains

Aug 19, 2026

CN=Specimen Research Lab

Subject

CN=Specimen Research Lab

Serial Number

64:e2:1b:d9:c2:99:05:a0:4c:f7:ce:fd:3e:2a:54:bc

Issuer

CN=Specimen Research Lab

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2026 - Aug 18, 2029

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

1340384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCommandLineW DeleteFileW SetCurrentDirectoryW LocalFree ReadFile FindFirstFileW GetFileSizeEx FindNextFileW GetModuleFileNameW GetEnvironmentVariableW CreateFileW GetFileAttributesW MultiByteToWideChar GetTickCount64 CloseHandle GetCurrentProcessId CreateProcessW WideCharToMultiByte GetLocaleInfoW GetTimeZoneInformation GetUserDefaultLCID GetNativeSystemInfo GetLocalTime GetComputerNameW GetCurrentProcess GetCurrentThread GetThreadContext GetSystemFirmwareTable Sleep GlobalMemoryStatusEx GetDiskFreeSpaceExA GetModuleHandleW AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA HeapReAlloc RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LockFileEx GetFileSize DeleteCriticalSection GetProcessHeap SystemTimeToFileTime FreeLibrary GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers VirtualProtect VirtualQuery LoadLibraryExA WriteConsoleW GetStringTypeW SetEnvironmentVariableW QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetExitCodeThread WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW DuplicateHandle GetFileType IsProcessorFeaturePresent ExitProcess TerminateProcess GetStdHandle GetCommandLineA RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter LoadLibraryExW CompareStringW LCMapStringW GetConsoleOutputCP GetConsoleMode GetExitCodeProcess CreatePipe SetStdHandle SetFilePointerEx ReadConsoleW FindClose FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW

user32

GetSystemMetrics

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

220KB

Virtual Size

220KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_90287d674eccf05c630c75ee579258fd_cobalt-strike_icedid_njrat_satacom_stealc

PE Signature issue

kernel32

user32

generic