2026-08-28_7d084f7cd74c8042936030fdcab46020_cobalt-strike_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-28_7d084f7cd74c8042936030fdcab46020_cobalt-strike_icedid_njrat_satacom
Size 183KB
Sample260828-qxdtzsysf1
SHA256 32093b107c8da2ef4d48043e9ff6f176f744d4dc2612b5828a25ae0dc592bed1
MD5 7d084f7cd74c8042936030fdcab46020
SHA1 414e6386c9bf7df08d196a3217ec012f8514df5f
SHA512 94600f34c085c2e44cb3db0a605a11b9007d1cd163e8ccf4bc2c4f3c66d68fa19b9b7b16f580963986425b82d6969f0d5243b7185482c49aa7d970e3c19ab484
SSDEEP 3072:I2msXr3F1eLQ7wEj6/C0MP7l3xFEDw95NjtoBbVvLUX:NLr3FnwEj6/9U9rD6a
TLSH
T169046D45B3E900F5E17382388AA54A16E772B81507359BEF07A04775EF336E19E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-28_7d084f7cd74c8042936030fdcab46020_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-08-28_7d084f7cd74c8042936030fdcab46020_cobalt-strike_icedid_njrat_satacom

.exe 183KB

2026-08-28_7d084f7cd74c8042936030fdcab46020_cobalt-strike_icedid_njrat_satacom

IMPHASH 099722aace9eafc62af3912fe7ad99ab
SHA256 32093b107c8da2ef4d48043e9ff6f176f744d4dc2612b5828a25ae0dc592bed1
MD5 7d084f7cd74c8042936030fdcab46020
SHA1 414e6386c9bf7df08d196a3217ec012f8514df5f
SHA512 94600f34c085c2e44cb3db0a605a11b9007d1cd163e8ccf4bc2c4f3c66d68fa19b9b7b16f580963986425b82d6969f0d5243b7185482c49aa7d970e3c19ab484
SSDEEP 3072:I2msXr3F1eLQ7wEj6/C0MP7l3xFEDw95NjtoBbVvLUX:NLr3FnwEj6/9U9rD6a
TLSH
T169046D45B3E900F5E17382388AA54A16E772B81507359BEF07A04775EF336E19E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

inet_pton WSAStartup ntohl setsockopt send recv htons connect closesocket socket

bcrypt

BCryptSetProperty BCryptGenerateSymmetricKey BCryptGetProperty BCryptEncrypt BCryptDestroyKey BCryptDeriveKeyPBKDF2 BCryptGenRandom BCryptOpenAlgorithmProvider

crypt32

CryptUnprotectData

iphlpapi

GetAdaptersAddresses

advapi32

RegOpenKeyExW RegCloseKey GetUserNameW RegQueryValueExW

user32

EnumDisplaySettingsW GetKeyboardLayoutList

ntdll

RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader RtlCaptureContext RtlGetVersion RtlVirtualUnwind

kernel32

WriteConsoleW HeapSize GetFileSizeEx GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW SetStdHandle GetModuleHandleW UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleMode CreateFileW GetFileAttributesW ReadFile CloseHandle GetLastError Sleep MultiByteToWideChar WideCharToMultiByte HeapAlloc HeapFree GetProcessHeap GetVolumeInformationW QueryPerformanceCounter QueryPerformanceFrequency GlobalMemoryStatusEx GetSystemInfo GetModuleFileNameW GetComputerNameW GetLocaleInfoW DeleteFileW FindClose FindFirstFileW FindNextFileW GetCurrentProcessId LocalFree CopyFileW GetFileType SetFilePointerEx DuplicateHandle GetCurrentProcess OpenProcess GetCommandLineW GetProcAddress GetFileInformationByHandleEx GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetCommandLineA GetConsoleOutputCP FlushFileBuffers HeapReAlloc SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RaiseException GetStdHandle WriteFile ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW

Name

.text

Size

118KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

53KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

3KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-28_7d084f7cd74c8042936030fdcab46020_cobalt-strike_icedid_njrat_satacom

ws2_32

bcrypt

crypt32

iphlpapi

advapi32

user32

ntdll

kernel32

generic