2026-08-26_edb0eed0b4663cb024b7b354525caad4_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-26_edb0eed0b4663cb024b7b354525caad4_cobalt-strike_icedid_njrat_satacom_stealc
Size 632KB
Sample260827-efwspagb79
SHA256 6dec33a728382f4f1aad2564fe8ee5900673ca51183efa9f74856033d2b0c897
MD5 edb0eed0b4663cb024b7b354525caad4
SHA1 8d9315841e0d73bd6b96389f3464ac4d1821ce82
SHA512 b02aa8af8735fa0c19447d290d7bf32d78d197de3ef3b7e5cc3e7cbed89bf68ab59aa4f7632130aee22e440c4036cdab8d5ce0330bb0b6a3ab219cc6a830b919
SSDEEP 6144:sc0uYS84avXweA8OzThF2YQ/ZpVHH18U9TBp9gwXh8:RQ6ugXnhcYQ/7gU9T38
TLSH
T18AD442279B2289C6F56607B1D0C58B40EC7A2AB2C783D3A623C07CE635267D459737B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-26_edb0eed0b4663cb024b7b354525caad4_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-26_edb0eed0b4663cb024b7b354525caad4_cobalt-strike_icedid_njrat_satacom_stealc

.exe 632KB

2026-08-26_edb0eed0b4663cb024b7b354525caad4_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 06e30b3948950c036590e83f081dbff2
SHA256 6dec33a728382f4f1aad2564fe8ee5900673ca51183efa9f74856033d2b0c897
MD5 edb0eed0b4663cb024b7b354525caad4
SHA1 8d9315841e0d73bd6b96389f3464ac4d1821ce82
SHA512 b02aa8af8735fa0c19447d290d7bf32d78d197de3ef3b7e5cc3e7cbed89bf68ab59aa4f7632130aee22e440c4036cdab8d5ce0330bb0b6a3ab219cc6a830b919
SSDEEP 6144:sc0uYS84avXweA8OzThF2YQ/ZpVHH18U9TBp9gwXh8:RQ6ugXnhcYQ/7gU9T38
TLSH
T18AD442279B2289C6F56607B1D0C58B40EC7A2AB2C783D3A623C07CE635267D459737B7
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

100832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\G4MINGSYST3M\Desktop\BF\Block Finder\x64\Release\Block Finder.pdb

kernel32

LCMapStringW LoadLibraryExW VirtualProtect GetLocaleInfoW ReadConsoleW GetFileSizeEx ReadFile SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile SizeofResource LockResource LoadResource FindResourceW MulDiv HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle GetModuleFileNameW GetProcAddress TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread CloseHandle GetLastError WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread GetLogicalProcessorInformationEx QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary RtlUnwind

user32

SetProcessDpiAwarenessContext DrawTextW InvalidateRect TrackMouseEvent SetCursor LoadCursorW FillRect BeginPaint GetClientRect EndPaint DefWindowProcW SetWindowTextW PostMessageW GetWindowTextW DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW UpdateWindow ShowWindow AdjustWindowRect ReleaseDC GetDC RegisterClassExW GetSystemMetrics CreateWindowExW RegisterClassW LoadImageW PostQuitMessage KillTimer SetTimer EnableWindow InflateRect LoadIconW GetWindowLongPtrW SetClassLongPtrW GetDpiForWindow GetFocus SendMessageW

comdlg32

GetSaveFileNameW GetOpenFileNameW

comctl32

ord413 ord410 ord412 InitCommonControlsEx

gdi32

DeleteDC BitBlt CreateCompatibleDC CreateDIBSection Polygon SetTextColor GetStockObject DeleteObject RoundRect SelectObject CreatePen CreateSolidBrush CreateFontIndirectW MoveToEx LineTo Ellipse Rectangle SetBkColor CreateCompatibleBitmap SetBkMode GetDeviceCaps

dwmapi

DwmSetWindowAttribute

gdiplus

GdiplusShutdown GdipFree GdipAlloc GdipDisposeImage GdipCloneImage GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipBitmapLockBits GdipBitmapUnlockBits GdiplusStartup

shlwapi

ord12

Name

.text

Size

230KB

Virtual Size

229KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

282KB

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-26_edb0eed0b4663cb024b7b354525caad4_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

comdlg32

comctl32

gdi32

dwmapi

gdiplus

shlwapi

generic