2026-08-25_dd3e3706aac38ee8d8ea4f3139561df8_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_dd3e3706aac38ee8d8ea4f3139561df8_cobalt-strike_icedid_njrat_satacom_stealc
Size 464KB
Sample260826-gs34msgq3v
SHA256 c97367ab7ec677361ec252d8a48b7ac7768e9855a0b9c0dba1333b596de40df7
MD5 dd3e3706aac38ee8d8ea4f3139561df8
SHA1 d481f1b5c2ee107833e110c29483fed4bfb44511
SHA512 0245144afdc30417a5ac781bc77d106190911ecf1b2c3200709b2321559f1fb28432d5de16a26e31ad8a8f008993a2186b3dbf1b8152a8eea4cc317e53fb6303
SSDEEP 6144:0tRkhZpK0UcAT4RacXEBlZgsYfMWJBuELqi3v73k1PdMisLjdgtz0KsPu/tf:W8pKWRRaFgHeE9o1tEhgtz0Xu
TLSH
T194A45C66665804FCE1B7D2B8CA174903E772B84A0371ABDF03D0A9721F176E59E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_dd3e3706aac38ee8d8ea4f3139561df8_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-25_dd3e3706aac38ee8d8ea4f3139561df8_cobalt-strike_icedid_njrat_satacom_stealc

.exe 464KB

2026-08-25_dd3e3706aac38ee8d8ea4f3139561df8_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 1b2c4b59a5285e27854ac23720eef0c6
SHA256 c97367ab7ec677361ec252d8a48b7ac7768e9855a0b9c0dba1333b596de40df7
MD5 dd3e3706aac38ee8d8ea4f3139561df8
SHA1 d481f1b5c2ee107833e110c29483fed4bfb44511
SHA512 0245144afdc30417a5ac781bc77d106190911ecf1b2c3200709b2321559f1fb28432d5de16a26e31ad8a8f008993a2186b3dbf1b8152a8eea4cc317e53fb6303
SSDEEP 6144:0tRkhZpK0UcAT4RacXEBlZgsYfMWJBuELqi3v73k1PdMisLjdgtz0KsPu/tf:W8pKWRRaFgHeE9o1tEhgtz0Xu
TLSH
T194A45C66665804FCE1B7D2B8CA174903E772B84A0371ABDF03D0A9721F176E59E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

188992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen

urlmon

URLDownloadToFileA

user32

GetDC ReleaseDC BeginPaint GetMessageA TranslateMessage DispatchMessageA PeekMessageA SendMessageA SetForegroundWindow PostThreadMessageA DefWindowProcA PostQuitMessage UnregisterClassA RegisterClassExA DrawTextA GetSystemMetrics MapVirtualKeyA GetKeyState CreateWindowExA IsWindow DestroyWindow ShowWindow PostMessageA GetClientRect EndPaint SystemParametersInfoA LoadCursorA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA FrameRect FillRect MessageBoxA InvalidateRect SetWindowPos

gdi32

Polygon SetTextColor SetBkMode SelectObject GetStockObject DeleteObject DeleteDC CreateSolidBrush CreateFontA CreateCompatibleDC CreateCompatibleBitmap BitBlt

shlwapi

PathFileExistsA

crypt32

CryptBinaryToStringA CryptStringToBinaryA CryptUnprotectData

ole32

CoUninitialize CoInitialize CoCreateInstance

advapi32

RegCreateKeyExA AdjustTokenPrivileges RegSetValueExA RegQueryValueExA RegOpenKeyExA RegDeleteValueA OpenProcessToken RegCloseKey GetUserNameA LookupPrivilegeValueA

shell32

SHGetFolderPathA ShellExecuteA

kernel32

FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetConsoleOutputCP GetOEMCP LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW GetExitCodeProcess GetFileAttributesExW CreatePipe HeapReAlloc IsValidCodePage CompareStringW GetACP RtlVirtualUnwind RtlCaptureContext FindFirstFileExW FindNextFileW FreeLibrary GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize CreateFileW WriteConsoleW SetEndOfFile IsProcessorFeaturePresent CreateProcessW DuplicateHandle GetCurrentDirectoryA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetDiskFreeSpaceExA WriteFile GetTempPathA GetVolumeInformationA IsDebuggerPresent Beep CloseHandle WaitForSingleObject Sleep GetCurrentProcess ExitProcess TerminateProcess CreateThread OpenProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount GetVersionExA GetModuleFileNameA GetModuleHandleA GetProcAddress LocalFree CopyFileA MoveFileA GetComputerNameA GetConsoleWindow RtlUnwind Process32First Process32Next FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError GetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader GetModuleHandleW GetStartupInfoW GetModuleHandleExW CreateToolhelp32Snapshot SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx MultiByteToWideChar GetCPInfo WideCharToMultiByte LCMapStringEx

gdiplus

GdipCloneImage GdipDisposeImage GdiplusShutdown GdipCreateBitmapFromFile GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdiplusStartup GdipFree GdipAlloc GdipGetImageEncoders GdipSaveImageToFile

avicap32

capCreateCaptureWindowA

bcrypt

BCryptDecrypt BCryptGenerateSymmetricKey BCryptDestroyKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

Name

.text

Size

334KB

Virtual Size

333KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_dd3e3706aac38ee8d8ea4f3139561df8_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

urlmon

user32

gdi32

shlwapi

crypt32

ole32

advapi32

shell32

kernel32

gdiplus

avicap32

bcrypt

generic