2026-08-28_0332537cc9699bb5db69a66fc446d91d_cobalt-strike_icedid_satacom

General

Target
2026-08-28_0332537cc9699bb5db69a66fc446d91d_cobalt-strike_icedid_satacom
Size 118KB
Sample260828-3cks1sthph
SHA256 143dc4207a4be6c6add2d4eda1ded122f7705d8e7bfafce453b86062d628eef8
MD5 0332537cc9699bb5db69a66fc446d91d
SHA1 b89bc9f00f67a0db41e8bfd1bcdbf7ea344f5d26
SHA512 e7f977a3130e1bbc8ab594f648ae57a3a597fc4064768ed206b561ea08a3012891159ee746503de7cf811312e0cf92be8dfe3d28af1a043e29dfff730f187180
SSDEEP 3072:LMiDTB05Qnr5eviTAd2/+5xnNKXGS3FZtz9NF1pm5oy:dB0inr5XN/KxnErVZBCoy
TLSH
T147C37C5777F930F8E277863884A14655EB72B8311761AFEF07A0429A1E233D09E3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-28_0332537cc9699bb5db69a66fc446d91d_cobalt-strike_icedid_satacom

File Explorer

2026-08-28_0332537cc9699bb5db69a66fc446d91d_cobalt-strike_icedid_satacom

.exe 118KB

2026-08-28_0332537cc9699bb5db69a66fc446d91d_cobalt-strike_icedid_satacom

IMPHASH 2180618c0aabfabffdb24c1d20e55d41
SHA256 143dc4207a4be6c6add2d4eda1ded122f7705d8e7bfafce453b86062d628eef8
MD5 0332537cc9699bb5db69a66fc446d91d
SHA1 b89bc9f00f67a0db41e8bfd1bcdbf7ea344f5d26
SHA512 e7f977a3130e1bbc8ab594f648ae57a3a597fc4064768ed206b561ea08a3012891159ee746503de7cf811312e0cf92be8dfe3d28af1a043e29dfff730f187180
SSDEEP 3072:LMiDTB05Qnr5eviTAd2/+5xnNKXGS3FZtz9NF1pm5oy:dB0inr5XN/KxnErVZBCoy
TLSH
T147C37C5777F930F8E277863884A14655EB72B8311761AFEF07A0429A1E233D09E3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b2:43:fd:2e:f8:ac:47:bb:80:79:0d:cf:4e:bc:fc:fc:9f:7c:b1:30

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=stepa,O=Blalz,L=New York,C=RU,1.2.840.113549.1.9.1=#0c0e42616c7a40676d61696c2e636f6d

Chains

Aug 27, 2026

CN=stepa,O=Blalz,L=New York,C=RU,1.2.840.113549.1.9.1=#0c0e42616c7a40676d61696c2e636f6d

Subject

CN=stepa,O=Blalz,L=New York,C=RU,1.2.840.113549.1.9.1=#0c0e42616c7a40676d61696c2e636f6d

Serial Number

7c:9a:b9:3d:0a:2e:60:39

Issuer

CN=stepa,O=Blalz,L=New York,C=RU,1.2.840.113549.1.9.1=#0c0e42616c7a40676d61696c2e636f6d

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 27, 2026 - Aug 27, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Minor OS version

0

Major OS version

6

Entry point

4832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\stepa\source\repos\ConsoleApplication4\x64\Release\ConsoleApplication4.pdb

shell32

ShellExecuteW

kernel32

HeapAlloc WriteConsoleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle

Name

.text

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-28_0332537cc9699bb5db69a66fc446d91d_cobalt-strike_icedid_satacom

PE Signature issue

shell32

kernel32

generic