2026-08-20_a74c0da730af45af3efa3a69be08159c_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_a74c0da730af45af3efa3a69be08159c_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.7MB
Sample260820-hmvezsca23
SHA256 611e733e70f3876f3d931ec537fb627ad482f249e346a74170c8b1c61bc03cdb
MD5 a74c0da730af45af3efa3a69be08159c
SHA1 cb67c6bb44a4c9bed4bcf38014c9529719cd63c6
SHA512 dbacc92b67715c6c71a84ce3bd054f736ea4151d21c98f15e21cc9506951fe4db165fe0fc8d05e495b8c45de4a75983c7d4297b5f5a807df93d01a5a8bd3a165
SSDEEP 24576:YltqDNfTdF9ehQ1mJ+0ugY670BvhrC63AXU4fv9W/L09:zDNpfqQ8Q0uA7SAXdfC
TLSH
T1BA858E07A3B540ECD16BC179CA165A07EBB174491330ABDB57D0CAA62F23BE15A7F720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_a74c0da730af45af3efa3a69be08159c_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-20_a74c0da730af45af3efa3a69be08159c_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.7MB

2026-08-20_a74c0da730af45af3efa3a69be08159c_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 57d73efc5313c4007ee70dcb92a94bc5
SHA256 611e733e70f3876f3d931ec537fb627ad482f249e346a74170c8b1c61bc03cdb
MD5 a74c0da730af45af3efa3a69be08159c
SHA1 cb67c6bb44a4c9bed4bcf38014c9529719cd63c6
SHA512 dbacc92b67715c6c71a84ce3bd054f736ea4151d21c98f15e21cc9506951fe4db165fe0fc8d05e495b8c45de4a75983c7d4297b5f5a807df93d01a5a8bd3a165
SSDEEP 24576:YltqDNfTdF9ehQ1mJ+0ugY670BvhrC63AXU4fv9W/L09:zDNpfqQ8Q0uA7SAXdfC
TLSH
T1BA858E07A3B540ECD16BC179CA165A07EBB174491330ABDB57D0CAA62F23BE15A7F720
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1257952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSetOption WinHttpOpen WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse

bcrypt

BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptCreateHash

crypt32

CryptUnprotectData

advapi32

RegCloseKey AllocateAndInitializeSid FreeSid GetUserNameW RegCreateKeyExA RegEnumKeyExA RegEnumKeyExW RegOpenKeyExA RegOpenKeyExW RegSetValueExA RegQueryValueExW RegQueryValueExA CheckTokenMembership

user32

CreateDesktopW ReleaseDC GetDC GetSystemMetrics CloseDesktop wsprintfW

rpcrt4

UuidCreateSequential

gdi32

SelectObject BitBlt GetDIBits DeleteDC CreateCompatibleDC CreateCompatibleBitmap DeleteObject

shell32

ShellExecuteExW

kernel32

LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation IsValidCodePage CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect UnhandledExceptionFilter RtlVirtualUnwind GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW OutputDebugStringW RtlCaptureContext GetStdHandle GetEnvironmentVariableA GetDiskFreeSpaceExA GetDiskFreeSpaceExW GetDriveTypeA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess CreateThread ResumeThread CreateProcessA CreateProcessW OpenProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount GetVersionExA ReadProcessMemory GetModuleFileNameW GetModuleHandleA GetProcAddress LoadLibraryA LocalFree GetComputerNameW MultiByteToWideChar WideCharToMultiByte GetConsoleMode SetConsoleMode SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile RtlUnwind GetFileAttributesExW GetFileAttributesA GetLastError GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 GetModuleHandleW CopyFile2 GetFileInformationByHandleEx InitializeCriticalSectionEx EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead GetCommandLineW RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCommandLineA

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

227KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_a74c0da730af45af3efa3a69be08159c_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

bcrypt

crypt32

advapi32

user32

rpcrt4

gdi32

shell32

kernel32

generic