2026-08-21_d5e7010229fc8bdb2f4f41a50b2ddadb_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_d5e7010229fc8bdb2f4f41a50b2ddadb_cobalt-strike_icedid_njrat_satacom_stealc
Size 268KB
Sample260821-eff28sscld
SHA256 3d55fd3d0bcc078484472ad5d44beb885bc762bbe557a20ff8f5279ab911b719
MD5 d5e7010229fc8bdb2f4f41a50b2ddadb
SHA1 6d46843ffec11b8795a6b63f82e7a2a3f32f3c68
SHA512 db4b7d2150c0b8eb79ab77565215b0604bd6f6d969eea8decbf40cc869db0e828ef73a83e4a2209a4774c72e8deb60ecded0810b566b13329e6f9e40138259af
SSDEEP 3072:5KCCQ5/zNrYcs2il0gxa4LC/pB8tVIdQsfZGroHTXBKFi568T1El:5KMqj2s0yChB2VofZYI5tpEl
TLSH
T1EF445C15E7E508E5F9B3863D89B58512EB727C115B30DADF03A4826A2F33BD09D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_d5e7010229fc8bdb2f4f41a50b2ddadb_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-21_d5e7010229fc8bdb2f4f41a50b2ddadb_cobalt-strike_icedid_njrat_satacom_stealc

.exe 268KB

2026-08-21_d5e7010229fc8bdb2f4f41a50b2ddadb_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 68caff0e48ae0e8397c2bdfc09db75bf
SHA256 3d55fd3d0bcc078484472ad5d44beb885bc762bbe557a20ff8f5279ab911b719
MD5 d5e7010229fc8bdb2f4f41a50b2ddadb
SHA1 6d46843ffec11b8795a6b63f82e7a2a3f32f3c68
SHA512 db4b7d2150c0b8eb79ab77565215b0604bd6f6d969eea8decbf40cc869db0e828ef73a83e4a2209a4774c72e8deb60ecded0810b566b13329e6f9e40138259af
SSDEEP 3072:5KCCQ5/zNrYcs2il0gxa4LC/pB8tVIdQsfZGroHTXBKFi568T1El:5KMqj2s0yChB2VofZYI5tpEl
TLSH
T1EF445C15E7E508E5F9B3863D89B58512EB727C115B30DADF03A4826A2F33BD09D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW GetUserNameA RegCloseKey RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW ChangeServiceConfig2W CloseServiceHandle ControlService CreateServiceW DeleteService EnumServicesStatusExW OpenSCManagerW OpenServiceW QueryServiceConfigW StartServiceW

ntdll

RtlPcToFileHeader RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlVirtualUnwind NtQuerySystemInformation RtlAdjustPrivilege

ws2_32

recv inet_addr htons connect WSAStartup send WSAIoctl WSAGetLastError WSACleanup setsockopt socket closesocket

user32

ShowWindow

kernel32

WriteConsoleW HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP ExpandEnvironmentStringsW CreateDirectoryW CreateFileW DeleteFileW GetFileSize ReadFile SetFileAttributesW WriteFile GetTempPathW OutputDebugStringW CloseHandle GetLastError CreatePipe PeekNamedPipe HeapAlloc HeapFree GetProcessHeap DeviceIoControl WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessA CreateProcessW OpenProcess GetTickCount64 VirtualAlloc VirtualProtect VirtualFree CreateFileMappingW MapViewOfFile UnmapViewOfFile FreeLibrary GetModuleFileNameW GetModuleHandleA GetProcAddress LoadLibraryA CopyFileW GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumDeviceDrivers SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ExitProcess GetModuleHandleExW GetStdHandle GetCommandLineA GetCommandLineW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter GetFileType WideCharToMultiByte LoadLibraryExW CompareStringW LCMapStringW

Name

.text

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_d5e7010229fc8bdb2f4f41a50b2ddadb_cobalt-strike_icedid_njrat_satacom_stealc

advapi32

ntdll

ws2_32

user32

kernel32

generic