2026-08-20_6bb1d0f03a29acbabcb03ad5fd01a1d1_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_6bb1d0f03a29acbabcb03ad5fd01a1d1_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.7MB
Sample260820-wbas4av1bs
SHA256 18d01c2e61946a9447692c142448219487b5c82626bbd7ccc46f68a9ae4ca42a
MD5 6bb1d0f03a29acbabcb03ad5fd01a1d1
SHA1 d55574ed91418c1ce51b6e55d0c455e5015d8537
SHA512 8c614fc59c60169b4101b6217e256fdf3ea5ccb400697da95b14bc79fb72b5602701272f40a37da259c21f6677c42535ccee04d80e8390528a69903ef873e0f0
SSDEEP 24576:xkqxk3mbJIGhDJeCncSKQLFsmXHR9ve/uZ4Jb6hgBGnDNYM6l:tk3UphJZcSKKFDe/ueJlF
TLSH
T1FA858E07A3B500ECD167D179CA169A07EBB174491330ABDB57D08EA62F23BE15A7F720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_6bb1d0f03a29acbabcb03ad5fd01a1d1_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-20_6bb1d0f03a29acbabcb03ad5fd01a1d1_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.7MB

2026-08-20_6bb1d0f03a29acbabcb03ad5fd01a1d1_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 225dfdd367e98a168773d641ab805154
SHA256 18d01c2e61946a9447692c142448219487b5c82626bbd7ccc46f68a9ae4ca42a
MD5 6bb1d0f03a29acbabcb03ad5fd01a1d1
SHA1 d55574ed91418c1ce51b6e55d0c455e5015d8537
SHA512 8c614fc59c60169b4101b6217e256fdf3ea5ccb400697da95b14bc79fb72b5602701272f40a37da259c21f6677c42535ccee04d80e8390528a69903ef873e0f0
SSDEEP 24576:xkqxk3mbJIGhDJeCncSKQLFsmXHR9ve/uZ4Jb6hgBGnDNYM6l:tk3UphJZcSKKFDe/ueJlF
TLSH
T1FA858E07A3B500ECD167D179CA169A07EBB174491330ABDB57D08EA62F23BE15A7F720
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1259072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSetOption WinHttpOpenRequest WinHttpSendRequest WinHttpOpen WinHttpReceiveResponse

bcrypt

BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptDecrypt

crypt32

CryptUnprotectData

advapi32

RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegEnumKeyExW RegEnumKeyExA RegCreateKeyExA RegCloseKey GetUserNameW

user32

GetSystemMetrics CloseDesktop CreateDesktopW wsprintfW

rpcrt4

UuidCreateSequential

kernel32

GetFileType EnumSystemLocalesW GetFileSizeEx IsValidLocale GetLocaleInfoW LCMapStringW ReadConsoleW GetConsoleOutputCP SetFilePointerEx GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW GetUserDefaultLCID UnmapViewOfFile CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetStdHandle GetEnvironmentVariableA GetDiskFreeSpaceExA GetDiskFreeSpaceExW GetDriveTypeA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess CreateThread ResumeThread CreateProcessA CreateProcessW OpenProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount GetVersionExA ReadProcessMemory GetModuleHandleA GetProcAddress LoadLibraryA LocalFree GetComputerNameW MultiByteToWideChar WideCharToMultiByte GetConsoleMode SetConsoleMode SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetLastError GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate RtlUnwind GetFileAttributesW CreateFileW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 GetModuleHandleW CopyFile2 GetFileInformationByHandleEx InitializeCriticalSectionEx EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead UnhandledExceptionFilter RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

226KB

Virtual Size

225KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_6bb1d0f03a29acbabcb03ad5fd01a1d1_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

bcrypt

crypt32

advapi32

user32

rpcrt4

kernel32

generic