2026-08-30_dd0abff8a97f1bdeced6c3253e5d981a_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-30_dd0abff8a97f1bdeced6c3253e5d981a_cobalt-strike_icedid_njrat_ryuk_satacom_stealc
Size 53.2MB
Sample260831-dfx53stflb
SHA256 2d4e318a8ce9f5def312af4b59f5661174e5a859567b4f0394028d27073bc858
MD5 dd0abff8a97f1bdeced6c3253e5d981a
SHA1 241029e570de6eda849bdc2ac63871dfeafb1d9a
SHA512 81120afaf5b5f932e6ae1c771ccbaa560b8cc77e1a9581a67c0c591b0a9c1c08b64895355d82f65585e247b8c98097582feb8d2788e93b93b50c404766668c7e
SSDEEP 786432:j2h9i61Jix1xTs4ea9Wy/UWkbKRFjOamd/MuoTod1Aqw/n:yhx1Jix04eaLceRFjOFEu2oEqw/n
TLSH
T14DC712D691D192F4C3E26070628E139BB8E134794A7C586F7BC21C136B30EEA995DF27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-30_dd0abff8a97f1bdeced6c3253e5d981a_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

File Explorer

2026-08-30_dd0abff8a97f1bdeced6c3253e5d981a_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

.exe 53.2MB

2026-08-30_dd0abff8a97f1bdeced6c3253e5d981a_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

IMPHASH db87bd6c67ea4a982f683ad5ec22496c
SHA256 2d4e318a8ce9f5def312af4b59f5661174e5a859567b4f0394028d27073bc858
MD5 dd0abff8a97f1bdeced6c3253e5d981a
SHA1 241029e570de6eda849bdc2ac63871dfeafb1d9a
SHA512 81120afaf5b5f932e6ae1c771ccbaa560b8cc77e1a9581a67c0c591b0a9c1c08b64895355d82f65585e247b8c98097582feb8d2788e93b93b50c404766668c7e
SSDEEP 786432:j2h9i61Jix1xTs4ea9Wy/UWkbKRFjOamd/MuoTod1Aqw/n:yhx1Jix04eaLceRFjOFEu2oEqw/n
TLSH
T14DC712D691D192F4C3E26070628E139BB8E134794A7C586F7BC21C136B30EEA995DF27
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard EnableWindow EnumWindows FindWindowA FindWindowW GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetSystemMetrics GetWindowTextA GetWindowTextLengthA IsWindow IsWindowUnicode IsWindowVisible LoadCursorW MessageBoxA MonitorFromWindow MsgWaitForMultipleObjects OpenClipboard PeekMessageW PostQuitMessage RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetProcessDPIAware SetWindowPos SetWindowsHookW ShowWindow TrackMouseEvent TranslateMessage UnregisterClassW UpdateWindow

kernel32

AcquireSRWLockExclusive AllocConsole AreFileApisANSI BeginUpdateResourceW CheckRemoteDebuggerPresent CloseHandle CopyFileW CreateDirectoryA CreateDirectoryW CreateFile2 CreateFileA CreateFileW CreateMutexW CreatePipe CreateProcessA CreateProcessW CreateRemoteThread CreateRemoteThreadEx CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EncodePointer EndUpdateResourceW EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameA GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetFileAttributesExW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetLastError GetLocaleInfoA GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemFirmwareTable GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetThreadContext GetTickCount GetTickCount64 GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32GetModuleFileNameExA LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree LockResource MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA Process32FirstW Process32NextW QueryFullProcessImageNameA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleTitleA SetEndOfFile SetEvent SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetThreadPriority SetThreadPriorityBoost SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SystemTimeToFileTime TerminateProcess UnhandledExceptionFilter UnmapViewOfFile UpdateResourceW VerSetConditionMask VirtualAlloc VirtualAllocEx VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile GetSystemTimeAsFileTime CreateEventA GetModuleHandleA TerminateProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep GetTickCount LoadLibraryA SystemTimeToFileTime FileTimeToSystemTime GlobalFree FreeLibrary HeapAlloc HeapFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar GetModuleHandleW LoadResource FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers FlsSetValue GetCommandLineA GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer DecodePointer FlsGetValue FlsFree SetLastError FlsAlloc GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException RtlPcToFileHeader RtlUnwindEx SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA GetModuleHandleA LoadLibraryA GetProcAddress HeapAlloc HeapFree ExitProcess

advapi32

CloseServiceHandle ControlService ConvertSidToStringSidA CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptDestroyKey CryptEncrypt CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext CryptVerifySignatureA GetUserNameA LookupAccountNameA OpenSCManagerA OpenServiceA QueryServiceStatus RegCloseKey RegCreateKeyExA RegCreateKeyW RegDeleteTreeW RegOpenKeyExA RegOpenKeyW RegQueryValueExA RegSetKeyValueW RegSetValueExA

shell32

CommandLineToArgvW SHChangeNotify SHGetFolderPathA ShellExecuteW

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoSetProxyBlanket CoUninitialize

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

iphlpapi

GetAdaptersAddresses

ntdll

NtQuerySystemInformation RtlInitUnicodeString

ws2_32

WSACleanup WSAStartup closesocket connect freeaddrinfo getaddrinfo recv send socket

secur32

AcquireCredentialsHandleW DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

dxgi

CreateDXGIFactory1

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3d11

D3D11CreateDeviceAndSwapChain

crypt32

CryptBinaryToStringA CryptDecodeObjectEx CryptImportPublicKeyInfo CryptStringToBinaryA

Name

.text

Size

5.8MB

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

832KB

Virtual Size

832KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1008KB

Virtual Size

1008KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.8KX

Size

15.7MB

Virtual Size

15.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.x0}

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.KNe

Size

29.7MB

Virtual Size

29.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.l1

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-30_dd0abff8a97f1bdeced6c3253e5d981a_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

user32

kernel32

advapi32

shell32

oleaut32

ole32

gdi32

iphlpapi

ntdll

ws2_32

secur32

dxgi

d3dcompiler_47

dwmapi

imm32

d3d11

crypt32

generic