2026-08-30_e34c2995ed8312d47a92558dccad3f8b_cobalt-strike_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-30_e34c2995ed8312d47a92558dccad3f8b_cobalt-strike_icedid_njrat_satacom
Size 966KB
Sample260831-csec3acm3y
SHA256 9a13e0dd48b8a431200a15ff392e3f97d94f3b2ffc9cf43cdf776110b409bfa1
MD5 e34c2995ed8312d47a92558dccad3f8b
SHA1 0758c8e6ba565cfe65507497b30ba81bfcb21f7e
SHA512 218549b66be143070fa5ece119eb8c576977d2c3e007e694177d69516b97472ce9219b80b8adaeb17cfcccc368db393eedd5cf70f35488da631b835535fdd95c
SSDEEP 24576:SkF4PWLTUKQkvlsoxEgiNnR7bdOyH6Xa:nF4bkar9NnzOyH6X
TLSH
T1F925AE51F2F445F8D46792398466AE1BF6363C1807204ADF23E866693FB73E01A7B721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-30_e34c2995ed8312d47a92558dccad3f8b_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-08-30_e34c2995ed8312d47a92558dccad3f8b_cobalt-strike_icedid_njrat_satacom

.exe 966KB

2026-08-30_e34c2995ed8312d47a92558dccad3f8b_cobalt-strike_icedid_njrat_satacom

IMPHASH dc4a3f119dd288a5cd77713d22c96463
SHA256 9a13e0dd48b8a431200a15ff392e3f97d94f3b2ffc9cf43cdf776110b409bfa1
MD5 e34c2995ed8312d47a92558dccad3f8b
SHA1 0758c8e6ba565cfe65507497b30ba81bfcb21f7e
SHA512 218549b66be143070fa5ece119eb8c576977d2c3e007e694177d69516b97472ce9219b80b8adaeb17cfcccc368db393eedd5cf70f35488da631b835535fdd95c
SSDEEP 24576:SkF4PWLTUKQkvlsoxEgiNnR7bdOyH6Xa:nF4bkar9NnzOyH6X
TLSH
T1F925AE51F2F445F8D46792398466AE1BF6363C1807204ADF23E866693FB73E01A7B721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

411312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

kernel32

FindResourceW GetProcAddress GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SizeofResource GetConsoleOutputCP FlushFileBuffers LCMapStringW LoadLibraryExW VirtualProtect SetFilePointerEx ReadConsoleW GetConsoleMode GetFileType CloseHandle UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapReAlloc HeapAlloc HeapFree IsProcessorFeaturePresent WriteFile LockResource LoadResource GetModuleHandleW SetStdHandle GetStdHandle GetModuleFileNameW GetStringTypeW CreateFileW HeapSize WriteConsoleW SetEndOfFile GetFileSizeEx AcquireSRWLockExclusive ReleaseSRWLockExclusive RtlUnwind WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReadFile GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW

user32

ScreenToClient ClientToScreen SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadCursorW SetWindowLongPtrW GetWindowLongPtrW GetSystemMetrics SetLayeredWindowAttributes CreateWindowExW RegisterClassExW GetCursorPos GetWindowRect UpdateWindow SetWindowPos ShowWindow DestroyWindow UnregisterClassW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage

shell32

ShellExecuteW

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

549KB

Virtual Size

548KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

130KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

253KB

Virtual Size

252KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-30_e34c2995ed8312d47a92558dccad3f8b_cobalt-strike_icedid_njrat_satacom

d3d11

dwmapi

kernel32

user32

shell32

imm32

d3dcompiler_47

generic