2026-08-20_3e1dda0dec37fae0bb5e11f2fcf92cad_cobalt-strike_icedid_satacom

General

Target
2026-08-20_3e1dda0dec37fae0bb5e11f2fcf92cad_cobalt-strike_icedid_satacom
Size 414KB
Sample260820-cybjcs1vbv
SHA256 a194d767568d751738e2c72e8ca6e35c5bc3d17ac57b693a2f1755c5d4bda3ce
MD5 3e1dda0dec37fae0bb5e11f2fcf92cad
SHA1 e0fc47d634d6706f25f6afd2ee355cc2ce6e5c81
SHA512 914bc66db26f176013758b6501b10affa37ad1199f1418b05bc6edd5cd9fd293a5235fad421cf10803abd3213c803b92b27b8763a025b725c4ad3f54eba49521
SSDEEP 6144:/kCxpK4u8RJIQwAxkVSSUPpRv7LXyvtjbehQgfyTe1iTGfS1hlf/bw4G2ELlWeiD:/kCm4ucXwAQ+23ewe9URpJd
TLSH
T1E794C063699637B4C159D6389521C02AF3A2F478231593BFADB841B96F037E48F34E92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-20_3e1dda0dec37fae0bb5e11f2fcf92cad_cobalt-strike_icedid_satacom

File Explorer

2026-08-20_3e1dda0dec37fae0bb5e11f2fcf92cad_cobalt-strike_icedid_satacom

.exe 414KB

2026-08-20_3e1dda0dec37fae0bb5e11f2fcf92cad_cobalt-strike_icedid_satacom

IMPHASH edd669ed6353263b02fafceed41df3a3
SHA256 a194d767568d751738e2c72e8ca6e35c5bc3d17ac57b693a2f1755c5d4bda3ce
MD5 3e1dda0dec37fae0bb5e11f2fcf92cad
SHA1 e0fc47d634d6706f25f6afd2ee355cc2ce6e5c81
SHA512 914bc66db26f176013758b6501b10affa37ad1199f1418b05bc6edd5cd9fd293a5235fad421cf10803abd3213c803b92b27b8763a025b725c4ad3f54eba49521
SSDEEP 6144:/kCxpK4u8RJIQwAxkVSSUPpRv7LXyvtjbehQgfyTe1iTGfS1hlf/bw4G2ELlWeiD:/kCm4ucXwAQ+23ewe9URpJd
TLSH
T1E794C063699637B4C159D6389521C02AF3A2F478231593BFADB841B96F037E48F34E92
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

a0:f3:0f:ba:35:47:06:d5:16:06:c6:8c:f6:dc:7d:c7:e8:48:4c:4e:c4:7d:d0:d1:13:9f:49:09:e0:40:fa:c0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nexus Systems\, Inc.\, O=Nexus Systems\, Inc.\, C=US

Chains

Aug 19, 2026

CN=Nexus Systems\, Inc.\, O=Nexus Systems\, Inc.\, C=US

Subject

CN=Nexus Systems\, Inc.\, O=Nexus Systems\, Inc.\, C=US

Serial Number

64:81:8c:ee:0a:a5:f4:8e:40:73:8d:30:41:b3:69:ef

Issuer

CN=Nexus Systems\, Inc.\, O=Nexus Systems\, Inc.\, C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2026 - Aug 19, 2029

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

16416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ReadFile GetModuleFileNameA HeapFree VirtualFree VirtualAlloc Sleep CreateFileA LoadLibraryA CloseHandle HeapAlloc GetFileSize GetProcessHeap GetProcAddress QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW WriteConsoleW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW

Name

.rsrc

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.pdata

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.text

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_3e1dda0dec37fae0bb5e11f2fcf92cad_cobalt-strike_icedid_satacom

PE Signature issue

kernel32

generic