2026-08-20_a671197b616c5b910a687d6419095094_cobalt-strike_icedid_njrat_satacom

General

Target
2026-08-20_a671197b616c5b910a687d6419095094_cobalt-strike_icedid_njrat_satacom
Size 156KB
Sample260820-yx4dmsfe98
SHA256 309243a952c938f5695ab537889e49a3d1f8c1759522fe6fbfa0c951471ce34b
MD5 a671197b616c5b910a687d6419095094
SHA1 9d935dccf7a63f4e418a97ec3255581a891665c5
SHA512 6c2942f97e6c229051ebee8c654bc51e605268addd95392f163d0efb686b2dd3ff593e0d0f227d2c9755902b784679819e8311b47fb1a00e646168566dd5ebf1
SSDEEP 3072:Ru9ZAsbac0OFyZ8v1n30QiB6RN1z3Zlt/QowWPJEo2g:rsb+Pr4N17ZlmX
TLSH
T137F36C1BB7A520F6E1779239C5A14A06F773783217209BEF03A446756F233D1AD3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_a671197b616c5b910a687d6419095094_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-08-20_a671197b616c5b910a687d6419095094_cobalt-strike_icedid_njrat_satacom

.exe 156KB

2026-08-20_a671197b616c5b910a687d6419095094_cobalt-strike_icedid_njrat_satacom

IMPHASH 81be680d710ca625f63cd661eb560ab9
SHA256 309243a952c938f5695ab537889e49a3d1f8c1759522fe6fbfa0c951471ce34b
MD5 a671197b616c5b910a687d6419095094
SHA1 9d935dccf7a63f4e418a97ec3255581a891665c5
SHA512 6c2942f97e6c229051ebee8c654bc51e605268addd95392f163d0efb686b2dd3ff593e0d0f227d2c9755902b784679819e8311b47fb1a00e646168566dd5ebf1
SSDEEP 3072:Ru9ZAsbac0OFyZ8v1n30QiB6RN1z3Zlt/QowWPJEo2g:rsb+Pr4N17ZlmX
TLSH
T137F36C1BB7A520F6E1779239C5A14A06F773783217209BEF03A446756F233D1AD3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CheckTokenMembership FreeSid AllocateAndInitializeSid

kernel32

GetStdHandle GetLastError Sleep VirtualProtect GetModuleHandleW GetProcAddress SetConsoleTextAttribute QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW WriteConsoleW RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree CloseHandle WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW HeapAlloc LoadLibraryExW CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc CreateFileW RtlUnwind

Name

.text

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_a671197b616c5b910a687d6419095094_cobalt-strike_icedid_njrat_satacom

advapi32

kernel32

generic