2026-08-22_e2e651570ec42e9ff6131802f90a7738_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-22_e2e651570ec42e9ff6131802f90a7738_cobalt-strike_icedid_njrat_satacom_stealc
Size 2.3MB
Sample260822-2f5rxscm8x
SHA256 e9678c2698eb9f3f7a1f11c35b1fe9d1ca77b456175cf2a3a02767aca6d00359
MD5 e2e651570ec42e9ff6131802f90a7738
SHA1 b7aefd2d83461d3718a2f49ec29c9a18d1734d49
SHA512 c7004ff754da720e85793037f9b32dc3216e0fb24ba15398da209762be8d8fe2bebfaaeecf1d7c14c6b5a8c0a4ba91f2dbe691d5da5236c31bc2b9767acd0c30
SSDEEP 49152:sWMH4s7o6ztBaLRxYgL4crw6h0o0MPq9Tvq:zamrNFnq9
TLSH
T1C7B5D021B2A442FCD07BD1B8CA674A06FB7278450370AADF03A059666F37BE54A7F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_e2e651570ec42e9ff6131802f90a7738_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-22_e2e651570ec42e9ff6131802f90a7738_cobalt-strike_icedid_njrat_satacom_stealc

.exe 2.3MB

2026-08-22_e2e651570ec42e9ff6131802f90a7738_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 2868ec0ffe3691ac85e0bb6212b0af32
SHA256 e9678c2698eb9f3f7a1f11c35b1fe9d1ca77b456175cf2a3a02767aca6d00359
MD5 e2e651570ec42e9ff6131802f90a7738
SHA1 b7aefd2d83461d3718a2f49ec29c9a18d1734d49
SHA512 c7004ff754da720e85793037f9b32dc3216e0fb24ba15398da209762be8d8fe2bebfaaeecf1d7c14c6b5a8c0a4ba91f2dbe691d5da5236c31bc2b9767acd0c30
SSDEEP 49152:sWMH4s7o6ztBaLRxYgL4crw6h0o0MPq9Tvq:zamrNFnq9
TLSH
T1C7B5D021B2A442FCD07BD1B8CA674A06FB7278450370AADF03A059666F37BE54A7F711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

129744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW ConvertStringSidToSidW OpenProcessToken

winhttp

WinHttpOpenRequest WinHttpCrackUrl WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpen WinHttpSendRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

kernel32

SetEndOfFile WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW HeapReAlloc GetOEMCP GetACP IsValidCodePage GetTempPathW CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcess CreateRemoteThread GetExitCodeThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LocalFree SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW CreateFile2 AreFileApisANSI GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW RtlUnwind

Name

.text

Size

263KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

222KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_e2e651570ec42e9ff6131802f90a7738_cobalt-strike_icedid_njrat_satacom_stealc

advapi32

winhttp

shell32

ole32

kernel32

generic