2026-08-26_f1471a95777581ed8bceaded394d63e3_cobalt-strike_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-26_f1471a95777581ed8bceaded394d63e3_cobalt-strike_icedid_njrat_satacom
Size 9.6MB
Sample260827-dprdwsxtb1
SHA256 270dddedec01e543cd138e8510a5b39e1de3fe05de9ab8227ec2caf1dd14b4ed
MD5 f1471a95777581ed8bceaded394d63e3
SHA1 f3e82ec89d789ccce13a42841816df51619d3956
SHA512 ad78c6077497913a93fab9b3061d2947e2315400327e1f4b85d28b4687b858135b88f25a21cd2feb27199a523a6b1ca5d3a449bb94a3be153715aef38d996759
SSDEEP 196608:CjG9du5MByU7VKCu/FCZOII+dmhvUUERJMXdqcWTAj8vJM8:iGamBp7VKx66+xUoMXsAj8C
TLSH
T1EAA623C2F75450A9DC3A8034C1934F12AA327C7DC3811BDB63CCFA296A537D15EAA65B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-26_f1471a95777581ed8bceaded394d63e3_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-08-26_f1471a95777581ed8bceaded394d63e3_cobalt-strike_icedid_njrat_satacom

.exe 9.6MB

2026-08-26_f1471a95777581ed8bceaded394d63e3_cobalt-strike_icedid_njrat_satacom

IMPHASH 38e771cf06b272a9719d72ddd8f4d981
SHA256 270dddedec01e543cd138e8510a5b39e1de3fe05de9ab8227ec2caf1dd14b4ed
MD5 f1471a95777581ed8bceaded394d63e3
SHA1 f3e82ec89d789ccce13a42841816df51619d3956
SHA512 ad78c6077497913a93fab9b3061d2947e2315400327e1f4b85d28b4687b858135b88f25a21cd2feb27199a523a6b1ca5d3a449bb94a3be153715aef38d996759
SSDEEP 196608:CjG9du5MByU7VKCu/FCZOII+dmhvUUERJMXdqcWTAj8vJM8:iGamBp7VKx66+xUoMXsAj8C
TLSH
T1EAA623C2F75450A9DC3A8034C1934F12AA327C7DC3811BDB63CCFA296A537D15EAA65B
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

440304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

wininet

HttpSendRequestA InternetOpenA HttpOpenRequestA InternetConnectA InternetCloseHandle InternetReadFile InternetOpenUrlA

bcrypt

BCryptVerifySignature BCryptOpenAlgorithmProvider BCryptImportKeyPair BCryptCloseAlgorithmProvider BCryptDestroyKey

kernel32

AreFileApisANSI GetModuleFileNameA MoveFileA CloseHandle GetLastError WaitForSingleObject CreateRemoteThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleHandleA GetProcAddress CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateFileA GetFileSize ReadFile GetFileAttributesA WriteFile GetTempPathA GetModuleHandleW LoadResource LockResource SizeofResource FindResourceA GetVolumeInformationA IsDebuggerPresent CheckRemoteDebuggerPresent RaiseException GetCurrentProcess GetCurrentProcessId TerminateProcess GetCurrentThreadId SetThreadPriority SuspendThread ResumeThread GetThreadContext GetSystemTimeAsFileTime GetTickCount64 VirtualProtect VirtualQuery WideCharToMultiByte Thread32First Thread32Next Sleep FlushInstructionCache OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA IsDBCSLeadByte GetLocaleInfoEx FormatMessageA LocalFree OpenThread InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetCurrentThread

user32

CloseClipboard SetClipboardData GetClipboardData LoadCursorW ScreenToClient ClientToScreen GetCursorPos GetWindow OpenClipboard SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout SetCursor GetTopWindow FindWindowA GetWindowTextA GetWindowThreadProcessId EnumWindows TranslateMessage DispatchMessageW PeekMessageW SendMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow SetLayeredWindowAttributes IsWindowVisible ReleaseCapture GetSystemMetrics UpdateWindow SetForegroundWindow GetWindowLongA SetWindowLongA EmptyClipboard

shell32

ShellExecuteW

msvcp140

_Query_perf_frequency _Query_perf_counter ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Xinvalid_argument@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exception@std@@YA_NXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Random_device@std@@YAIXZ

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

vcruntime140

__C_specific_handler memcmp memchr __std_terminate memset memmove __current_exception memcpy __current_exception_context _CxxThrowException __std_exception_copy __std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode free _callnewh malloc

api-ms-win-crt-string-l1-1-0

wcslen strlen tolower strcmp strncmp

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _beginthreadex _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _errno terminate

api-ms-win-crt-convert-l1-1-0

strtol strtoull

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __p__commode _set_fmode __stdio_common_vsscanf fflush _wfopen __acrt_iob_func fclose fwrite feof ferror __stdio_common_vsprintf fgetc ungetc ftell fseek fread

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-math-l1-1-0

acosf ceilf sqrtf fmodf powf sinf ldexp __setusermatherr cosf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

Name

.text

Size

432KB

Virtual Size

432KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

859KB

Virtual Size

860KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.stub

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8.3MB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-26_f1471a95777581ed8bceaded394d63e3_cobalt-strike_icedid_njrat_satacom

advapi32

d3d11

d3dcompiler_47

wininet

bcrypt

kernel32

user32

shell32

msvcp140

imm32

vcruntime140

vcruntime140_1

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic