2026-08-22_c1b758822bcbbda2e50db7948c23c95e_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-08-22_c1b758822bcbbda2e50db7948c23c95e_cobalt-strike_icedid_njrat_satacom_stealc
Size 553KB
Sample260823-bd3xfa1fmf
SHA256 9d738a945f032df1a7c5a5d280108fbd27fbe5ceed2812041d226f3a962ddc48
MD5 c1b758822bcbbda2e50db7948c23c95e
SHA1 e9d9c8693a0555c5098fee5f5d0e93b1c28559ad
SHA512 6310004b590b6f94997d83cd1eb1f16dc6287f8838f2efcc4c88e39951f590d88cc462309c55e945f37eed2959a45f0c60ef040f5b676a67a4806979787b853a
SSDEEP 6144:vO8RixGiDyUHyq8kPo/wdFuSAUtMBfan2yAVyvne4pHhPor+fcmZ7H:v+xvuzq8kPo4CSXnnHGawr+fcmZ7
TLSH
T179C46D1AF96625F9D2B6C07CC552250AFA727C9A43705BCB63900AD71F237E8AE3D701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_c1b758822bcbbda2e50db7948c23c95e_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-22_c1b758822bcbbda2e50db7948c23c95e_cobalt-strike_icedid_njrat_satacom_stealc

.exe 553KB

2026-08-22_c1b758822bcbbda2e50db7948c23c95e_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 4c08bb3238e91771aaa15fd8826b459e
SHA256 9d738a945f032df1a7c5a5d280108fbd27fbe5ceed2812041d226f3a962ddc48
MD5 c1b758822bcbbda2e50db7948c23c95e
SHA1 e9d9c8693a0555c5098fee5f5d0e93b1c28559ad
SHA512 6310004b590b6f94997d83cd1eb1f16dc6287f8838f2efcc4c88e39951f590d88cc462309c55e945f37eed2959a45f0c60ef040f5b676a67a4806979787b853a
SSDEEP 6144:vO8RixGiDyUHyq8kPo/wdFuSAUtMBfan2yAVyvne4pHhPor+fcmZ7H:v+xvuzq8kPo4CSXnnHGawr+fcmZ7
TLSH
T179C46D1AF96625F9D2B6C07CC552250AFA727C9A43705BCB63900AD71F237E8AE3D701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

87360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTempPathW CloseHandle WaitForSingleObject Sleep CreateRemoteThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleHandleA GetProcAddress CreateToolhelp32Snapshot Process32FirstW Process32NextW LocalFree FormatMessageA GetLocaleInfoEx WideCharToMultiByte MultiByteToWideChar GetStringTypeW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetLastError GetModuleHandleW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW SetEndOfFile RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetExitCodeProcess CreateProcessW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap CreateFileW HeapSize WriteConsoleW RtlUnwind

Name

.text

Size

233KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

219KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_c1b758822bcbbda2e50db7948c23c95e_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

generic